2

My client just received an email from PayPal regarding SHA-256 as follows:

"At PayPal, security and safety are our top priorities and, as a result, we’re implementing a series of security upgrades throughout 2016 and 2017. To comply with industry standards, we need to move our endpoints to stronger encryption known as SHA-256 by 30 September 2016.

In preparation for our transition to SHA-256, we'll be undertaking critical testing between 17 June and 29 September 2016. During this period, if your systems aren’t SHA-256 compatible, your business’ ability to accept payments with PayPal may be temporarily impacted. We strongly recommend that your systems are compatible with SHA-256 by 17 June to ensure that your business isn’t interrupted. If your systems aren’t SHA-256 compatible by the full cutover on 30 September, your business will be unable to accept payments with PayPal until changes are made. For more details about our transition to SHA-256, please go to 2016-2017 Merchant Security Roadmap Microsite."

The site is running EE v2.7.3 and Store v2.2.0 using PayPal Express as the gateway.

Is there anything that needs to be done to make the site SHA-256 compatible?

| improve this question | |
0

The only thing that you should need to do is contact your host to make sure that they are SAH-256 and G5 compatible. PayPal has a document on their resource website about the changes being implemented and when.

PayPal has already changed over their Sandbox sites to require SHA-256 encryption so if you have a dev site setup on the same server you can test with Sandbox API credentials to see if everything is compliant before the June 17th start dates.

| improve this answer | |
  • This shouldn't effect anything with PayPal Express checkout anyway since checkout is handled on their servers, correct? – mediapimp Jun 13 '16 at 15:58
  • I have this issue on my new website (about to be launched). How long should it take to implement these changes assuming that the site and host are not compatible? Also, my web developer does not host the site but is responsible for making sure everything works - do they or the host company have to have SHA-256 certification? Many thanks – JEG-UK Oct 11 '16 at 9:00
0

I wrote to my webhost, Nexcess, regarding that email from Paypal, and they said that this pertains to the SSL encryption used on the server. And you can test your site for compatibility here:

https://shaaaaaaaaaaaaa.com/

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.