CiviCRM Community Forums (archive)

Time to re-visit an old issue...

When I first wrote a payment processor I turning off ssl certificate verification in it as discussed in this thread
http://forum.civicrm.org/index.php?topic=3668.0 . My reasoning was the certificate check had been turned off in Paypal so the issues must have been thought through.

However, over time I have come to believe that the correct approach is to allow the certificate verification to be turned off through the front end configuration. This means that the implementer needs to make a conscious decision to accept the risk rather than do what may be involved in configuring the certificates correctly.

The option of setting the path to the certificate should also be included. This would enable people with limited access to put the root certification in an appropriate place and solve the windows limitation described here: http://kb.ucla.edu/articles/how-do-i-use-curl-in-php-on-windows

curl_setopt($ch, CURLOPT_CAINFO, 'C:/xampp/php/cacert.pem');
Simply saving this page as a file in that location makes it work.

http://curl.haxx.se/ca/cacert.pem

If this approach is seen as a good idea it would involve a handful of patches to existing payment processors. A bit of documentation work explaining the risks & what to do. (i.e that potentially a man in the middle attack could take place IF your web server or it's DNS server were to be compromised) which are things I could chip away at but probably more significantly it would probably mean that on upgrade people would need to be confronted with this choice which could cause confusion....