We are running a Portal application for our client with Payment Gateway integrated. Payment gateway uses SSL as it is suppose to be .
The concern for me is that our Portal application does not use HTTPS leaving it susceptible to MITM attacks but since the payment gateway uses SSL , are we still open to MITM attacks? What are the other risks involved ?
Based on the suggestions here , I will try to convince our client to buy a digital certificate from a registering certifying authority if it is needed .