Integration Guide

Securing Your Website Payments Standard Buttons
Protecting Payment Buttons by Using Encrypted Website Payments
6
260 September 2008 Website Payments Standard Integration Guide
z Private keys – Private keys are created by receivers are kept to themselves.
You create a private key and keep it in your system. PayPal keeps its private key on its
system.
z The encryption process – Senders use their private keys and receivers’ public keys to
encrypt information before sending it. Receivers use their private keys and senders’ public
keys to decrypt information after receiving it. This encryption process also uses digital
signatures in public certificates to verify the sender of the information.
You use your private key and PayPal’s public key to encrypt your HTML button code.
PayPal uses it’s private key and your public key to decrypt button code after people click
your payment buttons.
Setting Up Certificates Before Using Encrypted Website Payments
Do the following before you use Encrypted Website Payments to protect your payment
buttons:
z Generate your private key
z Generate your public certificate
z Upload your public certificate to your PayPal account.
z Download the PayPal public certificate from the PayPal website.
PayPal uses only X.509 public certificates, not public keys. A public key can be used for
decryption but contains no information identifying who provided the key. A public certificate
includes a public key along with information about the key, such as when the key expires and
who the key belongs to. PayPal accepts public certificates in OpenSSL PEM format from any
established certificate authority, such as VeriSign.
You can generate your own private key and public certificate using open source software such
as OpenSSL (
http://www.openssl.org), which is detailed in the following section.
Generating Your Private Key Using OpenSSL
Using the openssl program, enter the following command to generate your private key. The
command generates a 1024-bit RSA private key that is stored in the file my-prvkey.pem:
openssl genrsa -out my-prvkey.pem 1024
Generating Your Public Certificate Using OpenSSL
The public certificate must be in PEM format. To generate your certificate, enter the following
openssl command, which generates a public certificate in the file my-pubcert.pem:
openssl req -new -key my-prvkey.pem -x509 -days 365 -out my-pubcert.pem
Uploading Your Public Certificate to Your PayPal Account
To upload your public certificate to your PayPal account:
1. Log in to your PayPal Business or Premier account.
2. Click the Profile subtab.