3

I'm having issues with this order form (https://www.aishla.com/myaish/israel-trip-payment-form/#.VXc3Gud4zmE) where people are trying to purchase a trip but when they try to process a card they get the following error:

Payment Processor Error message 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

This is on a WPMU site using 4.5 of CiviCRM hosted on Lunarpages with Authorize.net as the payment processor.

Anuone know what steps I can take to correct this?

4

The issue is that the SSL certificate provided by your transaction processor is untrusted by your OS (or by the certs available to cURL).

The solution for a missing CA is -

  • to ensure the presence of correct CA certificates to cURL by installing system CA updates, or
  • to retrieve an old copy of the correct CA and make it available to cURL if the one used by your payment processor is invalid (see AGH link below).

Since the error message contains SSL3_GET_SERVER_CERTIFICATE, I wonder if this is happening because your payment processor extension is attempting to use SSLv3 (recently deprecated). You might want to check that if there are any references to CURLOPT_SSLVERSION in your payment processor, they are not set to 3. (You can set them to 0 as in this fix or simply remove the line.)

This issue was documented by AGH Strategies recently:

Authorize.NET say that you should make available three root CAs ("production certificate upgrades") link below.

"Please contact your solution provider and web hosting company to ensure your solution has these certificates installed and is capable of using them to secure your connection to Authorize.Net. In many cases the certificates may already be installed."

  • 3
    Yeah, I'm super-unhappy about the "solution" we posted, but that's the fundamental problem: Authorize.net is using an old certificate and hasn't updated it for months now even though it's a problem on nearly any Ubuntu box. Trusting it--so you can post contributions--requires reviving an old, insecure CA certificate. – Andrew Hunt Jun 11 '15 at 3:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.