FIX: You cannot use pipeline components to retrieve credit card numbers in a Commerce Server 2009 environment

Known issues with this hotfix

• When you remove this hotfix, a dialog box may prompt you that some applications must be closed before you can continue with the removal process. To continue with the removal process, accept the default selection in the dialog box, and then click OK.

• When you remove this hotfix, the Commerce Server 2007 Start menu may reappear. You can safely delete it.

Prerequisites

To apply this hotfix, you must have Commerce Server 2009 installed.

Installation instructions

To complete the installation of this hotfix, follow these steps:

1. Open a Commerce Server Tools Command Prompt window. To do this, click Start, point to All Programs, click Microsoft Commerce Server 2009, and then click Tools.

2. To generate a new public and private key pair, type the following command, and then press ENTER:

   ProfileKeyManager.exe /kn /o ProfileKeys.xml

3. To add the keys to the registry, type the following command, and then press ENTER:

   ProfileKeyManager.exe /ke /kf ProfileKeys.xml

4. Make the following changes to the appSetting element of the Web.config file for your website:

   • Full Encrypt and Decrypt Mode
     
     Use if both public and private keys are required.
     
     This option makes the credit card number and the validation code available to the Checkout PCF pipeline for credit card authorization purposes. These fields are deleted after the order is created.
     
     To use Full Encrypt and Decrypt Mode, add the following lines of configuration in the appSetting element of the Web.config file for your website:
     
     

     <add key="Microsoft.Commerce.Providers.CreditCardEncryption.Mode"value="EncryptDecrypt" />
     
     <add key="Microsoft.Commerce.Providers.CreditCardEncryption.PublicKey" value="registry:HKEY_LOCAL_MACHINE\Software\Microsoft\Commerce Server 2009 Keys\Default,PublicKey" />
     
     <add key="Microsoft.Commerce.Providers.CreditCardEncryption.PrivateKey" value="registry:HKEY_LOCAL_MACHINE\Software\Microsoft\Commerce Server 2009 Keys\Default,PrivateKey" />

   • Encrypt Only Mode
     
     Use if only a public key is required.
     
     This option leaves the encrypted credit card number and the validation code in the CreditCardPayment field. This field can be used after the order is created. This is useful for situations in which you want to use this data after the order is created.
     
     To use Encrypt Only mode, add the following lines of configurations in the appSetting element of the Web.config file for your website:

     <add key="Microsoft.Commerce.Providers.CreditCardEncryption.Mode" value="EncryptOnly" />
     
     <add key="Microsoft.Commerce.Providers.CreditCardEncryption.PublicKey" value="registry:HKEY_LOCAL_MACHINE\Software\Microsoft\Commerce Server 2009 Keys\DefaultSite,PublicKey" />

Note If you do not make any changes to the Web.config file, you will continue to experience the problem that is described in the "Symptoms" section.

Restart information

You do not have to restart the computer after you apply this hotfix. However, you must restart Internet Information Services (IIS) after you apply this hotfix. To restart IIS, open a Command Prompt window, type the following command, and then press ENTER:

iisreset /restartNote This option stops and then restarts all IIS services that are running.

Replacement information

This hotfix does not replace a previously released hotfix.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.