Are you going to be bitten by the SagePay Poodle?

We have had a few clients asking about the affect of SagePay making changes to their SSL encryption so we thought we would write a post. If you haven’t already seen it (you should have if you use SagePay for taking payments on your website) then the short version is - SSLv3 is going to be turned off.

What will this mean for your eCommerce store?

Nothing provided your web hosting provider is using a recent operating system to host your store. Anyone running Windows Server 2003 or very old Linux servers should be aware that SagePay payments will stop working sometime commencing 2nd February.

How can I test this?

Luckily there is an easy way to check if this is going to be an issue for your website as the SagePay test environment has already disabled SSLv3. From your web server (you may not have access to do this on shared hosting in which case you need to ask your web host to confirm there will be no issue) just try pulling up the following URL https://test.sagepay.com/gateway/service/vspdirect-register.vsp If it loads then you don’t need to worry… if it fails to connect then you need to take action right now.

What should I do now?

You have a couple of options. 1 - use another payment processor until you can get it sorted 2 - migrate your website to a server that supports better encryption (your webhost should be able to help you migrate)

Here is the snippet from the SagePay email

Following our recent communication via email we are contacting you to update you further on the ‘Poodle’ security issue and make you aware of the impact this could have on your business. We have identified you as a business at potential risk and it is critical that you take action to minimise impact on your business. In order to protect you and your shoppers, we will be disabling SSLv3 from our payment gateway from week commencing 2nd February 2015.