Answers.Body: <p>This is a notice regarding BOTH your website's SSL, and the ability of CiviCRM to use your system PHP and SSL libraries to connect to Paypal's SSL.</p>
  
  <p><strong>SHA-256 support on your site</strong></p>
  
  <p>If you use SSL on your website, you need to check that your certificate is SHA-256. This can be done quickly using <a href="https://shaaaaaaaaaaaaa.com/" rel="nofollow">shaaaaaaaaaaaaa.com</a>, and you can get a more thorough review from <a href="https://www.ssllabs.com/ssltest/" rel="nofollow">SSL Labs</a> (check for SHA-256 support in the results).</p>
  
  <p>Note that this will affect not just PayPal but <a href="http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html" rel="nofollow">also common browsers in the near future</a>. This is not CiviCRM specific.</p>
  
  <p><strong>SHA-256 support in your hosting stack</strong></p>
  
  <p>If your PHP or cURL libraries are old, or your server's root CAs do not match the updated certificates Paypal are migrating to, you may experience issues with payment when they update.</p>
  
  <p>Unless your hosting environment is shockingly outdated you're probably fine, but you should either test in advance that your hosting environment will handle the upgrade, OR be prepared for issues arising on September 30 when Paypal undertake their migration.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-01T03:24:46.243Z
Answers.LastActivityDate: 2015-09-14T21:18:24.520Z
Answers.LastEditDate: 2015-09-14T21:18:24.520Z
Answers.UserDisplayName: Chris Burgess
Answers.Body: <p>It seems it is about your ssl connection, so it's on the openssl layer connected to your webserver (apache or nginx).</p>
  
  <p>Test your ssl connection with that site, <a href="https://www.ssllabs.com/ssltest/">https://www.ssllabs.com/ssltest/</a> it will tell you what needs to be improved.</p>
  
  <p>In short, nothing to do with civicrm, but upgrading to the latest version is always a good idea anyway</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-11T22:08:50.643Z
Answers.Text: Xavier - could you review my alternate answer below please? I'm pretty sure that's *not* what PayPal are saying here.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-11T22:49:48.180Z
Answers.Text: Re-reading their SSL microsite, I may be wrong - will update my replies if we get a response from PayPal. There's [a related question now](http://civicrm.stackexchange.com/questions/6369/do-sites-without-ssl-now-need-one-for-paypal-ipn?lq=1) also with good input from DaveD. Everyone should just get SSL anyway.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-06-08T18:59:57.547Z
Answers.LastActivityDate: 2015-06-08T18:59:57.547Z
Answers.UserDisplayName: Xavier
Body: <p>Do I need to upgrade CiviCRM? Should I be concerned? I'm running  CiviCRM 4.4.4.</p>
  <p>See below:</p>
  <blockquote>
  <p>This is a reminder email. If you have already taken action, please ignore this notification.</p>
  <p>We’re contacting our merchants with some important information in response to an industry-wide security upgrade which is not unique to PayPal. This change involves upgrading Secure Sockets Layer (SSL) certificates over the course of 2015 and 2016. Our upgrade efforts for API endpoints are scheduled to start in June 2015.</p>
  <p>Because these changes are technical in nature, we advise that you consult with your partner, website vendor, or individuals responsible for your PayPal integration. They will be able to identify what, if any, changes are needed. Please forward the information below to your technical contact for evaluation. We are here to help your technical contact work through this to ensure you continue to process payments through your current integration with us.</p>
  <p>Full technical details can be found in our Merchant Security System Upgrade Guide. In addition, our <a href="https://www.paypal-techsupport.com/app/answers/detail/a_id/1237" rel="nofollow noreferrer">2015-2016 SSL Certificate Change microsite</a> contains a schedule of our service upgrade plan.</p>
  <p>Questions can be directed to our Merchant Technical Services team on our Technical Support website. Click here for more information.</p>
  </blockquote>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-09-01T14:46:54.123Z
Comments.Text: As the answers below state - this isn't a security issue with CiviCRM itself.  However, if you're running version 4.4.4, you ARE behind on security updates - consider upgrading to 4.4.19 or 4.6!
Comments.UserDisplayName: Jon G - Megaphone Tech
Tags: <paypal>
Title: PayPal Security notice, do I need to take action / upgrade Civi?
ThreadText: # PayPal Security notice, do I need to take action / upgrade Civi?
  
  (Asked by: username_0 on 2015-06-08)
  
  Do I need to upgrade CiviCRM? Should I be concerned? I'm running CiviCRM 4.4.4.
  
  See below:
  
  > This is a reminder email. If you have already taken action, please ignore this notification.
  >
  > We’re contacting our merchants with some important information in response to an industry-wide security upgrade which is not unique to PayPal. This change involves upgrading Secure Sockets Layer (SSL) certificates over the course of 2015 and 2016. Our upgrade efforts for API endpoints are scheduled to start in June 2015.
  >
  > Because these changes are technical in nature, we advise that you consult with your partner, website vendor, or individuals responsible for your PayPal integration. They will be able to identify what, if any, changes are needed. Please forward the information below to your technical contact for evaluation. We are here to help your technical contact work through this to ensure you continue to process payments through your current integration with us.
  >
  > Full technical details can be found in our Merchant Security System Upgrade Guide. In addition, our [2015-2016 SSL Certificate Change microsite](https://www.paypal-techsupport.com/app/answers/detail/a_id/1237) contains a schedule of our service upgrade plan.
  >
  > Questions can be directed to our Merchant Technical Services team on our Technical Support website. Click here for more information.
  
  **Tags:** paypal
  
  > **Comments:**
  > **username_1**: As the answers below state - this isn't a security issue with CiviCRM itself.  However, if you're running version 4.4.4, you ARE behind on security updates - consider upgrading to 4.4.19 or 4.6!  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_3 on 2015-06-08. Score: 8 | Accepted answer
  
  It seems it is about your ssl connection, so it's on the openssl layer connected to your webserver (apache or nginx).
  
  Test your ssl connection with that site, <https://www.ssllabs.com/ssltest/> it will tell you what needs to be improved.
  
  In short, nothing to do with civicrm, but upgrading to the latest version is always a good idea anyway
  
  > **Comments:**
  > **username_2**: username_3 - could you review my alternate answer below please? I'm pretty sure that's *not* what PayPal are saying here.  
  > **username_2**: Re-reading their SSL microsite, I may be wrong - will update my replies if we get a response from PayPal. There's [a related question now](http://civicrm.stackexchange.com/questions/6369/do-sites-without-ssl-now-need-one-for-paypal-ipn?lq=1) also with good input from DaveD. Everyone should just get SSL anyway.  
  
  ---
  
  ### Answer by username_2 on 2015-09-01. Score: 5
  
  This is a notice regarding BOTH your website's SSL, and the ability of CiviCRM to use your system PHP and SSL libraries to connect to Paypal's SSL.
  
  **SHA-256 support on your site**
  
  If you use SSL on your website, you need to check that your certificate is SHA-256. This can be done quickly using [shaaaaaaaaaaaaa.com](https://shaaaaaaaaaaaaa.com/), and you can get a more thorough review from [SSL Labs](https://www.ssllabs.com/ssltest/) (check for SHA-256 support in the results).
  
  Note that this will affect not just PayPal but [also common browsers in the near future](http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html). This is not CiviCRM specific.
  
  **SHA-256 support in your hosting stack**
  
  If your PHP or cURL libraries are old, or your server's root CAs do not match the updated certificates Paypal are migrating to, you may experience issues with payment when they update.
  
  Unless your hosting environment is shockingly outdated you're probably fine, but you should either test in advance that your hosting environment will handle the upgrade, OR be prepared for issues arising on September 30 when Paypal undertake their migration.
  
  
  ---
  
  