0

I am wanting to use Stripe to take donations on a website.

I understand that Stripe takes care of most of the PCI compliance but requires you to use Transport Layer Security (TLS) so that they make use of HTTPS according to their website.

My question is, since the flexible SSL option on Cloudlfare is not end-to-end, does it still count? I'm trying to understand if I should/am required to buy an SSL cert when Cloudflare can get my site to say it is HTTPS?

Please distinguish what is required from what is recommended in your answers, as I am trying to understand my options, if any.

Thank you.

2

No, Flexible SSL does not meet PCI requirements. Flexible SSL (emphasis mine):

Flexible SSL encrypts traffic from Cloudflare to end users of your website, but not from Cloudflare to your origin server.

which conflicts with PCI DSS §4.1 (emphasis mine):

Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks

You would need the Full SSL option from Cloudflare to be PCI compliant:

Full SSL mode provides encryption from end users to CloudFlare and from CloudFlare to your origin server. This requires an SSL certificate on your origin server. In Full SSL mode, you have three options for certificates to install on your server: one issued by a Certificate Authority (Strict), one issued by Cloudflare (Origin CA), or a self signed certificate. It is recommended that you use a certificate obtained through Cloudflare Origin CA.

A self-signed certificate won't cost you anything, and CloudFlare's Origin CA is also free and tries to simplify the certificate management.

1

Given that you're soliciting donations, I'm guessing your budget is small. You might have an alternate solution here.

Back I was doing e-commerce work, the simplest solution was to not collect or handle payment information on your own site (if the client would allow it)-- the user navigates your site, but when the time came to pay, you could redirect them to a TLS-protected site on Paypal's/(other processor) domain to make the payment.

This way, your entire site could operate in plaintext (barring login pages, etc) and the type of encryption you used to protect your own sensitive pages was at your discretion. You could get away with flexible SSL, because the actual PCI-compliant segments were protected end-to-end on the processor side.

(You still want some sort of HTTPS on your own site for the SEO benefit if nothing else.)

Once the payment is complete, they are redirected from the processor back to any "thank you" page on your own site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.