topic Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades in Integration and Testing

Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

RichardH — Tue, 24 Mar 2015 17:47:43 GMT

Authorize.Net is upgrading our infrastructure to enhance system performance and security. The changes will be made to our sandbox environment first with updates to production following at a date still to be determined.

See the full details in our blog post here.

Richard

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

greg1972 — Tue, 31 Mar 2015 20:37:07 GMT

Is the sandbox supposed to be returning html with the body: An unanticipated error has occurred?

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

rich722 — Tue, 31 Mar 2015 21:11:16 GMT

Just this week I started setting up a website with osCommerce and the sandbox version of Authorize.Net. Yesterday I got the whole authorization process to finally work, using the test credit card numbers (!). But today, suddenly, when osCommerce sends off the authorization request to the sandbox, again using test credit card numbers, it simpy reports back that there is a problem with the credit card and to try some other form of payment. Could this be related to the work you are now doing on the sandbox?? If so, any suggestions on where in osCommerce I now have to modify?

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

magalh — Tue, 31 Mar 2015 22:27:05 GMT

All the connections to sandbox has stopped working!

if i try to debug the response i get:

AuthorizeNetARB_Response Object ( [xml] => [response] => )

All the response block is missing. Live account works.

Is there anyone already working on fixing this issue?

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

Lilith — Tue, 31 Mar 2015 22:29:12 GMT

@greg1972 What are the reproduction steps?

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

Lilith — Tue, 31 Mar 2015 22:32:46 GMT

@rich722 I suggest contacting your web hosting company since this may be a matter of their server configuration--show them the post this is linked to, which has the technical details. It's also possible you may need to contact OScommerce for assistance in your configuration: http://www.oscommerce.com/Support

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

Lilith — Tue, 31 Mar 2015 22:33:51 GMT

@magalh Please refer to this post for technical details:

http://community.developer.authorize.net/t5/The-Authorize-Net-Developer-Blog/Authorize-Net-Begins-Infrastructure-and-SHA-2-Certificate/ba-p/49615

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

greg1972 — Tue, 31 Mar 2015 22:38:55 GMT

I am sending a validateCustomerPaymentProfileRequest and it is returning the html i mentioned above. This just started, as i have been working on a customer site and it hasn't happened before. Although i have not tested it since last week. It all started with ssl verification errors with curl. The sandbox url seems to have changed from apitest to just test, and that was causing ssl_verify_host errors because the hostname doesn't match the cert. I updated the class i am using to fix the host name. I then started receiving ssl_peer_verify errors as well. So i disabled that temporarily just to see what elese was happening, thats when i started seeing the underlying issue of the html being returned and not xml like my class is expecting.

Putting the url into the browser results in the same error response:

Error

An unanticipated error occurred while processing this request. Please click your browser’s Back button to return to the previous page.

Also,

Im am running Centos 6.6 with all the latest patches, i just updated this morning to make sure i wasnt missing something.

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

magalh — Tue, 31 Mar 2015 22:40:40 GMT

@Lilith Thanks

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

Lilith — Tue, 31 Mar 2015 23:19:59 GMT

@greg1972 There wasn't any URL change--apitest.authorize.net is used for our XML, SOAP, and JSON connections, while test.authorize.net is for our name-value pair API connections.

However, it appears the new GeoTrust certificate uses Subject Alternate Names (SAN) for all the domains on our Sandbox environment, including both apitest.authorize.net and test.authorize.net.

Can you check your security transport for SAN support, please?

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

magalh — Tue, 31 Mar 2015 23:39:55 GMT

@Lilith my php files are sitting on a godaddy shared hosting account. It's not very clear to me what kind of changes i could do to work with the SHA-2 certificate upgrades. Should i just wait because they are still working on the upgrade or you think there is something that i manually have to do?

Thanks for the help.

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

greg1972 — Tue, 31 Mar 2015 23:54:50 GMT

I was looking at the host name that was referenced in the ssl cert. I guess SAN was the issue, as after setting the url back to apitest it seems to be working fine after updating my machines php/curl/openssl earlier.

Thank you for your help.

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

Lilith — Wed, 01 Apr 2015 14:55:21 GMT

@magalh Thank you for posting your PHP changes in the blog post comments. We were updating our PHP SDK yesterday and should have the new version on GitHub shortly.

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

Lilith — Wed, 01 Apr 2015 16:02:46 GMT

@greg1972 Do you know which versions of PHP, cURL, and OpenSSL you were using before, and what you're using now?

I ask because the information might be helpful if anyone else has a similar issue.

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

rich722 — Wed, 01 Apr 2015 20:55:56 GMT

I contacted my host (InMotion) as you suggested, they looked into, and replied that everything is okay on their end. I am now trying to find out where osCommerce got the module for Authorize.Net . . . .

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

rich722 — Thu, 02 Apr 2015 19:32:12 GMT

@Lilith I did as you suggested and my host (InMotion) said they meet all the stated requirements (from the link you suggested). And there does not seem to be a problem with the osCommerce module for AIM. But I am still stuck. I tried setting the "Verify SSL Certificate" to false, and that *worked* giving me a successful authorization (I am still only testing in the sandbox in test mode using test cc numbers). Do you have any other suggestions about what next to investigate, given that the sandbox worked for me prior to March 31, and does not work now unless I turn off "Verify SSL Certificate"?

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

starweb — Thu, 09 Apr 2015 17:49:55 GMT

Is there any chance of getting you to provide a non-SAN cert for apitest.authorize.net as I have an application server running ColdFusion 8 which doesn't support certificates with SAN?

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

jimmyborofan — Sat, 18 Apr 2015 11:07:15 GMT

Last december I set up the sandbox for my clients site,

It took al weekend but we managed to get it wokrking wiht the right responses.

We were unsure how ling we would be developing for but we have finally managed to get the site into a position where we can go live.

So in final testing I start from scratch to register and when it comes to accepting payments via the sandbox, this happens

The sandbox accpets the payment and actually created the payment profile etc and the payment for the item is taken,

BUT

the XML response is that there is an unhandled exception and there is an error with the security certificate, I have read the 'SSL Security error - again' thread and followed the instructions on installing the trusted certificate onto the server, this has not resolved the issue.

Can you give me any pointers to resolve this issue please as the site is now on a deadline

Many thanks for any help

Jim

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

sethstevenson — Tue, 19 May 2015 14:46:37 GMT

I recently switched hosts to Godaddy and I can only get a SHA-2 cert. My website is running WordPress with Gravityforms and the Authorize.net Gravityforms Add-on. The payments seem to go through but it appears as if no response is coming back or being blocked somehow. Is this due to my SHA-2 cert? Is there anything I can do to get this to work in production?

Re: Authorize.Net Begins Infrastructure and SHA-2 Certificate Upgrades

Lilith — Wed, 20 May 2015 17:08:29 GMT

@sethstevenson The references to SHA-2 pertain only to our upcoming new SHA-2 certificates, not yours.

API calls on our system handle the request and the response on the same connection. If you are able to connect to us and successfully send a request, we will reply in the same connection with the response. Since you say payments go through, that tells me that the request is coming in just fine, and so there isn't any connectivity issue.

My guess is that your parser may not be reading the reply correctly. Make sure the parser starts with the first blank line following the HTTP response headers. Also, if you are connecting to api.authorize.net or apitest.authorize.net, you may need to be explicit about MIME types--text/xml for XML requests and responses, application/json for JSON requests and responses. (If you're using secure.authorize.net/test.authorize.net the MIME type doesn't have to be explicit, but text/plain is what I'd recommend.)

If these suggestions don't help, you may need to work with Gravityforms to make sure it's parsing correctly.