Re: Authorize.net DPM (PA/DSS Compliant)
 

Yep, their answer was to upgrade to the newest version since Authorize.net made some API changes. Best part is it cost $37.50 to upgrade a mod that I just bought recently to fix something that was broken by Authorize.net, even though the mod is supposed to be the connection to them. So they have to change something to get the mod to work correctly and WE get to pay the price for that.

Re: Authorize.net DPM (PA/DSS Compliant)
 

Mary,

I actually looked at your authorize.net and it looks and seems fine. I don't know what has changed on your site to cause you to start having issues. It would make sense for us to look into it with a service fee since it all of a sudden stopped working and you've had this version since March. However we have recently updated the mod to use Authorize.net's newest technology and it seemed to make sense to just update you at the same time as well.

Just let us know if you'd like us to help out as we'd love to get it working again for you.

thank you,

Carrie

Re: Authorize.net DPM (PA/DSS Compliant)
 

Just got a notification from Authorize.net that TLS 1.0 and 1.1 will be disabled in Sept. Will the Authorize.net DPM mod still work with 1.2 once they do that or will there need to be a change to the mod?

Re: Authorize.net DPM (PA/DSS Compliant)
 

make sure your api file says this for the live url:

const LIVE_URL = 'https://secure2.authorize.net/gateway/transact.dll';

in
[xcart_dir]/modules/BCSE_Authorizenet_DPM/lib/sdk-php/lib

also make sure your server can connect using tls 1.2

if using openssl as your ssl libary (this is found under security settings in xcart admin area (I think),

you can update it, if it fails the test below:
https://support.stripe.com/questions/how-do-i-upgrade-my-openssl-to-support-tls-1-2


Test your server's openssl version:
https://serverfault.com/questions/638691/how-can-i-verify-if-tls-1-2-is-supported-on-a-remote-web-server-from-the-rhel-ce

Re: Authorize.net DPM (PA/DSS Compliant)
 

Feel free to email us too if you still have questions. I don't think our module has this issue but we have also updated it recently to use their new methods so you may want an update for those reasons.

Thanks,

Carrie

Re: Authorize.net DPM (PA/DSS Compliant)
 

We are TLS 1.2 compliant as well if anyone needs a quick solution.

Carrie

Re: Authorize.net DPM (PA/DSS Compliant)
 

Authorize.net is implementing changes & as a result:
Any customers having the Authorize.net DPM prior to November 10, 2016 for versions 4.4.x through 4.7.x will need to get an updated module before July 19, 2019 according to Authorize.net:
https://developer.authorize.net/api/upgrade_guide/

Anyone running the Authorize.net DPM on 4.0.x through 4.3.x will need to contact us for customization so that their module will continue to work past July 2019.

Please contact us to receive a quote for the update or customization

Re: Authorize.net DPM (PA/DSS Compliant)
 

Just want to reiterate the importance of the above message!

We have helped update many clients to the latest Authorize.net methods but I'm sure there are others who haven't seen the messages!

Re: Authorize.net DPM (PA/DSS Compliant)
 

Most people have updated to the latest accept.js method but if you have not, don't forget! They discontinued previous DPM methods this summer!

Carrie

Re: Authorize.net DPM (PA/DSS Compliant)
 

Hi Carrie,

We are using your Authorize.net Accept.js module and I'm wondering which SAQ to use. There is a new one this year called SAQ (A-EP). It is very similar to SAQ (A) that your module recommends. Do you have an update as to which SAQ to use?

Thanks,
Vaughn

Re: Authorize.net DPM (PA/DSS Compliant)
 

Based upon the FAQ I'm seeing, for example on this web page:
https://www.securitymetrics.com/blog/saq-ep-what-and-how

It does seem that the SAQ (A-EP) makes sense.

I hope that helps! Feel free to email us if you have more questions!

thanks,

Carrie

Re: Authorize.net DPM (PA/DSS Compliant)
 

A word of caution here. The module encrypts the keys entered in admin - all 3 of them. But it does not add anything to the blowfish regeneration process.
So once you setup the module it will encrypt its settings with current blowfish key but if you then regenerate the blowfish key module settings will not be recrypted. Then all attempts to checkout with CC using this module will fail until the settings are re-entered and saved in admin.

Carrie you should look into this and revise the module. I had to get creative to get it back working on a client's site today as he did not have all the info saved somewhere else.

For anyone else the way I solved it was to modify the bcse decrypt function in the module and pass to it the old blowfish key - which you can get from config.php or the backup of the file.
The settings then properly populated in admin and resave encrypts them with the new key.

Don't forget after that to undo changes to the bcse decrypt function.

Re: Authorize.net DPM (PA/DSS Compliant)
 

Yes blowfish reencryption can mess up several things. We usually just don't recommend doing it as it's just a false sense of security updating it. We've seen sites come completely crashing down because of the amount of orders, etc that has to be redone overloading the server, making it crash and making the reencryption process die mid way, so that some things are encrypted with the new key and some with the old, etc.

Carrie