Install Xpayments on development site?

AMMoyer · #1 06-15-2012, 09:19 AM

Is there any reason not to go ahead and install Xpayments on my development site and then move the whole "shootin' match" when I'm ready to publish it?

Thanks.

cflsystems · #2 06-15-2012, 09:25 AM

No, there is no reason. You should install and test first before going live

photo · #3 06-15-2012, 09:55 AM

Can a test store connect to xpayments if xpayments installed in the root folder as follows,

root folder/xpayments
root folder/testsite/

or would it be better to do it as follows,

root folder/testsite/xpayments
root folder/testsite/
and then move the whole shooting match?

cflsystems · #4 06-15-2012, 10:03 AM

You can connect up to 10 store to one X-Payments install, no matter where these stores are or if they are life or not

gb2world · #5 06-15-2012, 11:55 AM

QT recommends that X-Payments be installed on a separate server, or, under a separate hosting account on the same server. If you have your own VPS or dedicated server, you can create another hosting account, put it there, and connect it to up to 10 stores. In this case, you would connect your development store to X-Payments, then move it to your live location when ready, or, copy it and create a new connection to X-Payments if you wish to keep your development in place. But X-Payments would stay where it is.

See the bottom part of this post, after the ======:
http://forum.x-cart.com/showpost.php?p=336735&postcount=135

---

photo · #6 06-15-2012, 12:20 PM

Quote:

Originally Posted by gb2world

QT recommends that X-Payments be installed on a separate server, or, under a separate hosting account on the same server. If you have your own VPS or dedicated server, you can create another hosting account, put it there, and connect it to up to 10 stores. In this case, you would connect your development store to X-Payments, then move it to your live location when ready, or, copy it and create a new connection to X-Payments if you wish to keep your development in place. But X-Payments would stay where it is.

See the bottom part of this post, after the ======:
http://forum.x-cart.com/showpost.php?p=336735&postcount=135

---

Unreal!

This just keeps getting more and more complicated. Its getting to the point with Xcart that only programmers and developers can install/upgrade and maintain it.

I've spent countless hours over the last week weighing up the options of upgrading from v4.1.x to v4.5.x and so far what I've came up with is its going to cost a lot of time, money and stress to upgrade to v4.5.x only to find that your site runs 4 times slower than the old site because of all the code bloat in 4.5.x
Then, after all of that you find out v5 is released!

Its disheartning I'm telling you and has really made me seriously consider an alternative cart. There is just no reason a person should have to be a programmer to use a shopping cart software. I don't mind learning a program, but they keep changing the goal post.

Well thats my rant, its been a long week, did make me feel a little better ranting tho I must say!

AMMoyer · #7 06-15-2012, 01:07 PM

It's my understanding that an SSL certificate is required to run Xpayments.

Do I need to have this in place prior to installing Xpayments or can I wait?

I only need the SSL cert. for my domain and not for Xpayments also, correct?

Thanks. Deadline's a coming....

gb2world · #8 06-15-2012, 01:27 PM

@Photo - It is a bit confusing. Installing on a separate server or a separate hosting account on the same server would seem to be advisable and safest. I think it is implied that this only applies to a shared server. If you have a dedicated server, I think you might be able to install it using the options that you listed - but best to seek advise from QT.

It would be instructive to hear from people who paid QT for installation. If you are on a shared server, did they tell you it must be in a separate hosting account or server, or did they install in a sub-directory? That would tell you definitively if it is okay to do it that way. But from their X-Payments FAQ and from the post I referenced, I think it must be in a separate account or server.

You should be able to have a separate account that uses a sub domain of your main domain, so the url will still be branded.

I agree that X-Payments is a difficult installation - especially if you have to install the connector for previous versions. It might be worth it to pay QT or other developer. With experience - they should be able to do it more quickly and easily.

@Ammoyer - if you install X-Payments under its own account or separate server, it will require its own SSL. It will be difficult to test it without the SSL installed. I am not sure why you would want to delay that part until later.

---

cflsystems · #9 06-15-2012, 08:15 PM

One thing to all of this - do not rely on QT to tell you what they think about this. Ask your bank. QT is not the one responsible or liable if your bank thinks you should have it on separate server and you don't, or vice versa. You are responsible. Your bank will not accept - well you know what QT told me this and that. QT has no authority to tell you what's right or wrong about this, QT can recommend, but your bank opinion is what matters.

gb2world · #10 06-15-2012, 10:12 PM

I am not a QSA and also not a merchant, so I might need to be corrected ...

I don't think QT is absolved of answering questions like this about the proper installation of the software, which they probably have included in their own certification process. I think they have spent a lot of money for PA-DSS certification and the >$1k X-Payments price includes the installation instructions approved by their own QSA.

We must be able to depend on QT's installation instructions and their own PA-DSS certification. Aren't their installation instructions part of what has been certified?

I think they answer the question in their X-Payments FAQ and in the post I referenced about installing on a separate server or hosting account on a shared server. Only if I wanted to not follow those directions would I think to get my own QSA approval and/or approval from the bank's compliance officer.

Most compliance officers that I have dealt with, which is a very small sample, do not get into that kind of detail with the software that is on the PCI-DSS approved list on the PCI Security Standards website. (I don't think small businesses hire their own QSA - they rely on the PCI-DSS certification process of the vendor and self certification?)

For software that is on the approved list on the PCI Security Standards website - all they seem to need to know is that we have properly installed it following the vendor's directions, so we can self-certify with SAQ-C. The vendor (QT) is the one that certified it, so they should be able to tell us the right way to install it and remain compliant with what their QSA certified. That is why it would be important for QT to have all these good questions answered in their installation instructions and FAQ, and not depend on each of us to get certification to that amount of detail. If you can tell the compliance officer that you are using PA-DSS certified software, demonstrate it is on the approved list, and that you have followed the vendor's installation instructions, that would seem to be enough. (You can find the X-Payments software on the web site approval list under Creative Development, LLC.)

But the more assurance you have from that person in writing, the better off you are if there ever are issues. I've just not seen bank compliance officers, in my limited experience, who understand that level of detail and answer those kinds of questions.

It is only when using something not clearly on the list, like DPM, that I've had to get the compliance officer more involved - to make sure they approve it for SAQ-A (can't use any other SAQ because it is not approved).

If I wanted to deviate from the installation instructions, I would expect that would also require re-certification, or at least, some kind of approval.

---