https and ssl

[Corey Bryant]

thanks for your answers Corey

My hosting provider ( re-invent technologies ) does have a plan to set up https and a CSR - So does that mean I first have to get the hosting company( re-invent ) to somehow give the SSL certificate provider the CSR or do I have access to this CSR?

A CSR is used to get the SSL Cert. If you can get the CSR yourself then you can go out and buy any SSL Cert that you want.

So if my hosting company sets me up with https, how do I get some pages to be https and others not? - I am still confused about this.

You just change the hyperlink to http://www.example.com/order.asp to https://www.example.com/order.asp. It is really that simple, no rpcket science here.

If you can use ASP, you can place this code at the top of the ASP to force https:

<%
dim servPro 
servPro = Request.ServerVariables("HTTPS")

if servPro = "off" then
   ' response.redirect  "https://www.example.com/order.asp"
   ' response.end
end if
%>

Here is an example: http://www.loudcommerce.com/merchant...pplication.asp - if you click on that link you will see that I am not calling https but if you look at the URL you will see https and a secure lock. We added the code above to make sure there would be a secure connection between the server and the browser. This encrypts the data between the two and does not transmit in plain text.

I have been in contact with authorize.net and they provided me with a developers key and login - this I assume I can use to test out transmition of payment transactions - I am assuming that this kind of handles the need to set up a merchant account as far as testing goes using their API.

No - you need a merchant account and an electronic payment gateway - remember? There are two parts to this when accepting credit cards.

Unfortunately I am in Canada and they only support US merchant accounts with their API. I so far have not been able to find something in Canada that is similar but I am not going to worry about that for now. I just want to clear up the technical details first.

Being in Canada, chances are very slim that you can use the electronic payment gateway Authorizenet.com. Authorizenet.com is compatible with United States merchant account providers (MAPS).

To get a merchant account in the United States and you are not a citizen - you need at least a United States bank account, United States address, and United States phone number. And even then, only a very few MAPs will support you and the discount rate will be higher than what people who live in the United States.

You might check out Beanstream, Paymentech, PSIgate for starters since you are in Canada.

So as far as all these shopping carts go - how come I do not see very much info about integrating the merchant account with them or info on making the pages dealing with sensitve issues secure? They give the impression that there is basically no setup involved - I find that hard to believe - There seems to me to have to be some sort of integration with your merchant account and the payment processor. Also do these shopping cart pages reside on their server or do you have to install them on your own host provider?

You do not integrate the cart with a merchant account. It is integrated with a an electronic payment gateway.

You might check out How Does a Credit Card Transaction Get Processed? and How Does a Credit Card Transaction Get Processed? to see if those help.

As far as the shoping carts - most people have the code on their own server. Some people use a shared SLL on another domain. Some people also use the gateway's secure payment page as well. it all depends on what you want.

I seem to be really stuck on something that I have not been able to find too much info on. I don't know how other people are dealing with these issues but from the lack of info I can find, it does not seem to be a problem for them. Why me?

I think you are just trying to make it more difficult. Some of this is very complicated while other parts are not.