By travis-bradbury on
Change record status: 
Published (View all published change records)
Project: 
Commerce Authorize.Net
Introduced in branch: 
7.x-1.x
Introduced in version: 
7.x-1.5
Issue links: 
https://www.drupal.org/node/1931760
Description: 

The SSL certificate for Authorize.net must now be verified. If unable to verify the certificate you will be unable to process payments.

This change prevents man-in-the-middle attacks where an attacker could receive customer payment information.

Most sites should not be affected by this. Out-of-date sites that experience a problem have a variety of options to resolve the issue:

  • Update dependencies like OpenSSL, libcurl, or their system's certificate authority certificate store.
  • Utilize paragonie/certainty to obtained updated certificates.
  • Update your php.ini to point to your CA certificate bundle with the curl.cainfo setting.
  • Manually provide a CA certificate bundle file from http://curl.haxx.se/docs/caextract.html, place it in a safe location on the web server, and update settings.php to set the commerce_authnet_cacert variable to contain the absolute path to the file.
Impacts: 
Site builders, administrators, editors