Urgency: low-medium
Impact to donors: receiving strange error message in english, looks unprofessional and losing donations
Note to @atgo: This wasn't reported at all in IL, but I don't know if I can rule out the issue in case it was a WPG thing. Feel free to close this task if you think it's no longer relevant.
From 11/14/2014:
Number of donors impacted: At least 10 have contacted us since Friday. It seems the payment failure related to this error are not making it to WP so we can't quantify how many are seeing this and not contacting us
We have received word from a number of French donors who say that after entering their credit card details and clicking Submit, they are sent to this page:
It looks like it's probably a WP page, but there's not much to go off of. A very tech savvy donor sent us the reply below — I think he can explain this better than I ever could. Two other donors confirmed they were using Firefox and probably had to do with browser security:
I tried to donate to Wikipedia but could not, as my web browser (Firefox) is configured not to accept the RC4 algorithm for SSL connections. The RC4 algorithm is considered insecure nowadays. Apparently, RC4 is all that the web server ott9.wpstn.com supports, as I get the error message that no overlap in supported encryption algorithms was found.
The SSL scan results obtained on https://www.ssllabs.com/ssltest/analyze.html?d=ott9.wpstn.com&hideResults=on support this finding.
Please, can you arrange for the SSL stack on this server to allow more secure symmetric algorithms than RC4, so that people with web browsers configured for higher security can donate?
I don't have Civi IDs or WP order IDs for these donors because they didn't seem to make it that far. Two questions:
- Is there a reason they're getting a WP error and not one from us?
- Is there anything we can do based on the donor's suggestion above to change the way we connect through SSL?