CCbill forcing sites on https

[cybermike]

Surprised its not being talked about much since I see a lot of ccbill sites still not on it.. Been ignoring the flood of emails but sounds like we need to put our ccbill paysites on https or they wont work properly?

[bns666]

refer.ccbill.com is not on https, why don't they first do it on their own?

[tony286]

Why wouldn't you want to do that?

[cybermike]

Just saying I bet a ton of old ccbill sites not on the same page.. Hope doing this doesn't break my old scripts lol

[Klen]

Any site which have members should have https, end of story.

[RyuLion]

Any site which have members should have https, end of story.

There's free SSL out there also guys..

[blackmonsters]

Surprised its not being talked about much since I see a lot of ccbill sites still not on it.. Been ignoring the flood of emails but sounds like we need to put our ccbill paysites on https or they wont work properly?

This is the solution :


https://letsencrypt.org/


If you have Plesk as your server admin then just login and install for each domain.
If you have cpanel, I haven't checked that out yet.

I'm testing my plugin with that now and camsoda has issues.
The https makes their video not play unless I put in a redirect for regular http.

[cybermike]

Sure not worried about that part.. was worried about the cms breaking but tested it on one of my tiny ones and seemed to work fine..

So guess I'm good and will be bugging my host tomorrow to move them over to https

But see a lot of solo girl sites not on https yet.. even zishy.com

[blackmonsters]

Sure not worried about that part.. was worried about the cms breaking but tested it on one of my tiny ones and seemed to work fine..

So guess I'm good and will be bugging my host tomorrow to move them over to https

But see a lot of solo girl sites not on https yet.. even zishy.com

OH yeah! Good point.
I forgot about other CMS out there with the http in the DB.
But it works fine for Wordpress when used in plesk.
Don't even blink if it's a wordpress site.

[mikeet]

But see a lot of solo girl sites not on https yet.. even zishy.com

Probably because of their loyal following, they may feel its not necessary yet..

[His Infernal Majesty]

From CCBill.

I wanted to assure you that this is not the case. We are not requiring that our merchants use SSL, but we do recommend it. The emails we have been sending out are informing merchants who do use SSL that in order to continue to work properly with our system, to receive consumer information after a successful sale, their system has to support TLS 1.2, which basically means they need to use a newer version of SSL.

These changes are ONLY for merchants using SSL, and if you do not use SSL, you do not have to worry about these changes.

[Look Chang]

^^^ Big thanks for this clarification.

[cybermike]

Hello Mike,

Thank you for your email.

If your server host do support TLS 1.2, you need to update your servers to TLS 1.2. You need to make sure that any of your sites that use SSL support TLS 1.2.

If that is not the case then after the change on 2018-06-11, we will have issues communicating with your server.

From what I see you are utilizing a http protocol on these two websites, you should have a https instead of just http. The “s” at the end of http indicates that it is a secure encrypted connection of SSL or TLS.

With that being said, best way to ensure that there is no interruption of your services with CCBill is that you contact your developer/webhost to inquire your servers/websites are TLS 1.2 enabled.

--
Regards,

Marko M.

[cybermike]

And asking if can opt out

Hello Mike,

I'm afraid there is no work around for this. If you don't update, there is a big chance that you will not receive webhooks, postbacks, or any feature you are using in Management system.

[His Infernal Majesty]

You need to make sure that any of your sites that use SSL support TLS 1.2.

They are saying you should use https just because it's more secure in general...but they are also saying above this change will only affect sites using https. These statements are independent of each other. You can't "opt out" if you are using https.

[rowan]

I read it as the ccbill API requires you support TLS 1.2, which is different to ccbill requiring that your "site" moves to HTTPS.

In other words, surfer clicks from a HTTP site to a ccbill HTTPS URL will still work just fine. Notwithstanding the browsers nagging about insecure sites, but that's nothing to do with this ccbill change.