Paypal-checkout-components: Paypal certificate used to load resources

Created on 16 May 2018 · 12Comments · Source: paypal/paypal-checkout-components

Hi I just find that chrome is advising that PayPal use a systematic certificate, and soon users will start to see a notice that the page is not private.

"The SSL certificate used to load resources from https://www.paypal.com will be distrusted in M70. Once distrusted, users will be prevented from loading these resources. See https://g.co/chrome/symantecpkicerts for more information."

What should we do about this? is PayPal going to fix this? because if the notice starts to appear user will find our site as not private, and we will start to have issues with this, is hard to explain to user that is not our site, is PayPal, and the payment method is not secure!.

Thanks, and sorry for my english, maybe this is not the place to put my question, but couldn't find a better place.

Source

chefuss

👍5

All 12 comments

@chefuss thanks for reporting this, I will let my team know and we will follow up with you on this.

khanghoang on 22 May 2018

This is known and we have a team working on it. Will be resolved by the release of chrome 70.

trainerbill on 6 Jun 2018

👍1

This issue is preventing my site from taking payments at the moment. Is there a resolution or am I to switch Payment providers? My client now has a non-functioning e-commerce site and are unable to make sales. As you can appreciate, this is quite an emergency.

UserCentrix on 13 Jul 2018

For developers hitting this already, here's a couple of suggestions that can help depending on your situation:

1. Check existence of `paypal` before using it:

function isPaypalAvailable() { return !!window.paypal; }
if (isPaypalAvailable()) { paypal.Button.render(...) }

Admittedly this may only be helpful if you've got other non-Paypal payment methods.

2. Self-host paypal checkout.js

~~Some guidance here:~~ https://github.com/paypal/paypal-checkout/blob/master/docs/cdn-npm.md

Update: this probably will not work, as it relies on the domains the paypal script communicates with having valid certs. If those domains also have invalid certs then this won't help.

eliotsykes on 17 Jul 2018

Update: The new certs will be going in the next few weeks with the last being targeted for completion the week of August 6.

@UserCentrix this should not be preventing your site from taking payments.

trainerbill on 17 Jul 2018

This is what is happening for PayPal Express checkout, page, this doesn't load properly due to resources in chrome. something going wrong.

dom.js:95 GET https://www.paypalobjects.com/web/res/019/65173d3c7f3abd282157c6a6b370d/locales/PK/en.js 404 ()

https://www.paypal.com/cgi-bin/webscr?cmd=_express-checkout&token=EC-7SM803396T7828254#/checkout/genericError?code=RETRY

najmulbasit-360training on 24 Jul 2018

Any update on this? We're past the previously stated August 6th date.

crookedneighbor on 13 Aug 2018

Last week of August.

trainerbill on 15 Aug 2018

Last week?
It is the last week of August now... All the updates are rolling out for browsers everywhere and people cannot pay.
I had to revert one of my browser versions just to be able to browse to paypal.