3

I have a Magento 1.8.1.0 e-commerce website updated with the latest security patches. It runs on a Linux machine with openSUSE 12.3 and:

PHP 5.3.17
Apache 2.2.29
MySQL  Ver 14.14 Distrib 5.5.33
OpenSSL 1.0.1j

The PayPal payment flow always worked fine until a month ago. Suddenly, without any code change, the orders stopped moving from the Pending Payment state to Processing. Customers are still able to pay for the order, however, they are not able to see the order in their personal area and they do not receive the corresponding automatic email.

Since the problem is just when users select the PayPal payment method during checkout (PayPal Pro is configured), I enabled the PayPal debug log from the admin panel and started analyzing logs. What I get in the file is a bunch output like this for every order with PayPal:

2016-09-26T07:09:59+00:00 DEBUG (7): Array (
[ipn] => Array
    (
        [address_city] => XXX
        [address_country] => XXX
        [address_country_code] => XX
        [address_name] => XXX XXX
        [address_state] => XX
        [address_status] => unconfirmed
        [address_street] => XXXXX
        [address_zip] => XXX
        [business] => XXX@XXX.it
        [charset] => windows-1252
        [custom] => 
        [first_name] => XXX
        [handling_amount] => 0.00
        [invoice] => XXXXX
        [ipn_track_id] => XXXXX
        [item_name] => 
        [item_number] => 
        [last_name] => XXXX
        [mc_currency] => EUR
        [mc_fee] => 4.06
        [mc_gross] => 148.34
        [notify_version] => 3.8
        [payer_email] => XXXX.XXXX@gmail.com
        [payer_id] => XXXX
        [payer_status] => unverified
        [payment_date] => 12:49:56 Sep 25, 2016 PDT
        [payment_fee] => 
        [payment_gross] => 
        [payment_status] => Completed
        [payment_type] => instant
        [protection_eligibility] => Eligible
        [quantity] => 1
        [receipt_id] => XXX-XXX-XXX-XXX
        [receiver_email] => XXX@XXX.it
        [receiver_id] => XXXXXXXXX
        [residence_country] => XX
        [shipping] => 0.00
        [tax] => 26.75
        [transaction_subject] => 
        [txn_id] => XXXXXXXXXXXXXXX
        [txn_type] => pro_hosted
        [verify_sign] => XXXXXXXXXXXX
    )

[postback] => mc_gross=148.34&invoice=800000925&protection_eligibility=Eligible&address_status=unconfirmed&payer_id=XXXXXX&tax=26.75&address_street=via+Val+Senio+12&payment_date=12%3A49%3A56+Sep+25%2C+2016+PDT&payment_status=Completed&charset=windows-1252&address_zip=XXXXX&first_name=XXX&mc_fee=4.06&address_country_code=XX&address_name=XXXX+XXXX&notify_version=3.8&custom=&payer_status=unverified&business=XXX%XXX.it&address_country=XXXX&address_city=XXX&quantity=1&verify_sign=XXXX-q8BJ&payer_email=XXX.XXX%40gmail.com&txn_id=XXXXXX&payment_type=instant&last_name=XXXX&address_state=XX&receiver_email=XXX%XXX.it&payment_fee=&receiver_id=XXXXX&txn_type=pro_hosted&item_name=&mc_currency=EUR&item_number=&residence_country=XX&receipt_id=2054-6203-1063-6630&handling_amount=0.00&transaction_subject=&payment_gross=&shipping=0.00&ipn_track_id=XXXXXXX&cmd=_notify-validate
[postback_to] => https://www.paypal.com/cgi-bin/webscr
[postback_result] => 
[exception] => PayPal IPN postback failure. See paypal_unknown_ipn.log for details.
[__pid] => 6037 )

Hence I found out that there was this exception PayPal IPN postback failure. See paypal_unknown_ipn.log for details.. I called the PayPal support that verified that the configuration both in the PayPal account and in my Magento website was correct. However nothing changed and the orders paid with PayPal are still not correctly processed.

I tried with this solution but, still the problem wasn't solved (hence i reverted back the changes).

Does anybody have an idea of how to solve this?

----------------------- UPDATE ------------------------

Since 2 days ago in the paypal logs the error slightly changed. The [postback_result] field is not empty and states:

[postback_result] => HTTP/1.1 403 Forbidden
Server: AkamaiGHost
Mime-Version: 1.0
Content-Type: text/html
Content-Length: 344
Expires: Tue, 04 Oct 2016 07:28:17 GMT
Date: Tue, 04 Oct 2016 07:28:17 GMT
Connection: close
Strict-Transport-Security: max-age=63072000

<HTML><HEAD>
<TITLE>Access Denied</TITLE>
</HEAD><BODY>
<H1>Access Denied</H1>

You don't have permission to access "&#47;D&#47;3694&#47;113982&#47;000&#47;new&#45;origin&#45;www&#46;paypal&#46;com&#46;akadns&#46;net&#47;cgi&#45;bin&#47;webscr" on this server.<P>
Reference&#32;&#35;18&#46;6bf01202&#46;1475566097&#46;4788ea27
</BODY>
</HTML>

I have also looked at the curl.log that has written:

* upload completely sent off: 1005 out of 1005 bytes
< HTTP/1.1 403 Forbidden
< Server: AkamaiGHost
< Mime-Version: 1.0
< Content-Type: text/html
< Content-Length: 344
< Expires: Thu, 06 Oct 2016 13:33:22 GMT
< Date: Thu, 06 Oct 2016 13:33:22 GMT
< Connection: close
< Strict-Transport-Security: max-age=63072000
< 
* Closing connection #0
* About to connect() to www.paypal.com port 443 (#0)
*   Trying 23.223.77.167...
* connected
* Connected to www.paypal.com (23.223.77.167) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs/
* SSL connection using ECDHE-RSA-AES256-SHA
* Server certificate:
*    subject: C=CA; ST=Ontario; L=Toronto; 1.3.6.1.4.1.311.60.2.1.3=CA; O=The Bank of Nova Scotia; businessCategory=Private Organization; serialNumber=1145427846; CN=see.sbi.com.mx
*    start date: 2015-04-22 13:15:17 GMT
*    expire date: 2017-04-23 01:28:40 GMT
*    issuer: C=US; O=Entrust, Inc.; OU=See www.entrust.net/legal-terms; OU=(c) 2014 Entrust, Inc. - for authorized use only; CN=Entrust Certification Authority - L1M
*    SSL certificate verify ok.
> POST /cgi-bin/webscr HTTP/1.1
Host: www.paypal.com
Accept: */*
Connection: close
Content-Length: 1005
Content-Type: application/x-www-form-urlencoded

* upload completely sent off: 1005 out of 1005 bytes
< HTTP/1.1 403 Forbidden
< Server: AkamaiGHost
< Mime-Version: 1.0
< Content-Type: text/html
< Content-Length: 344
< Expires: Thu, 06 Oct 2016 14:16:04 GMT
< Date: Thu, 06 Oct 2016 14:16:04 GMT
< Connection: close
< Strict-Transport-Security: max-age=63072000
< 

UPDATE

Now the response I get is empty as before. I logged in on the Paypal page of the PayPal account of my customer and now I am able to manually resend IPNs to my Magento IPN listener.

In my curl logs I read this :

* About to connect() to www.paypal.com port 443 (#0)
*   Trying 23.223.77.167...
* connected
* Connected to www.paypal.com (23.223.77.167) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none   CApath: /etc/ssl/certs/
* error:14077458:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 unrecognized name
* Closing connection #0

And then later something else gets logged:

> < HTTP/1.1 500 Internal Server Error < Date: Wed, 12 Oct 2016 10:59:18
> GMT < Server: Apache/2.2.29 (Linux/SUSE) < Vary:
> accept-language,accept-charset < Accept-Ranges: bytes < Connection:
> close < Content-Type: text/html; charset=iso-8859-1 <
> Content-Language: en < X-Pad: avoid browser bug < 
> * Closing connection #0
> * About to connect() to api-3t.paypal.com port 443 (#0)
> *   Trying 173.0.84.101...
> * connected
> * Connected to api-3t.paypal.com (173.0.84.101) port 443 (#0)
> * successfully set certificate verify locations:
> *   CAfile: none   CApath: /etc/ssl/certs/
> * SSL connection using AES256-SHA256
> * Server certificate:
> *      subject: C=US; ST=California; L=San Jose; O=PayPal, Inc.; OU=PayPal Production; CN=api-3t.paypal.com
> *      start date: 2015-09-11 00:00:00 GMT
> *      expire date: 2017-09-10 23:59:59 GMT
> *      issuer: C=US; O=Symantec Corporation; OU=Symantec Trust Network; CN=Symantec Class 3 Secure Server CA - G4
> *      SSL certificate verify ok.
> > POST /nvp HTTP/1.1 Host: api-3t.paypal.com Accept: */* Content-Length: 1675 Content-Type: application/x-www-form-urlencoded
> Expect: 100-continue

Is it normal? I have tried to force TLS1.2 editing the Ipn.php postback method but nothing changed:

    /**
 * Post back to PayPal to check whether this request is a valid one
 *
 * @param Zend_Http_Client_Adapter_Interface $httpAdapter
 */
protected function _postBack(Zend_Http_Client_Adapter_Interface $httpAdapter)
{
        $sReq = '';
        foreach ($this->_request as $k => $v) {
            $sReq .= '&'.$k.'='.urlencode($v);
        }
        $sReq .= "&cmd=_notify-validate";
        $sReq = substr($sReq, 1);
        $this->_debugData['postback'] = $sReq;
        $this->_debugData['postback_to'] = $this->_config->getPaypalUrl();

        $httpAdapter->setConfig(array('verifypeer' => $this->_config->verifyPeer));

        Mage::log("CURL_SSLVERSION_TLSv1_2");
        $httpAdapter->addOption(CURLOPT_SSLVERSION,6);//CURL_SSLVERSION_TLSv1_2

        $httpAdapter->write(Zend_Http_Client::POST, $this->_config->getPaypalUrl(), '1.1', array(
            'Connection: close', 'User-Agent: MASCAGNICASA'
        ), $sReq);

I have also tried to run from the Magento server:

openssl s_client -connect sha2-test-api.sandbox.paypal.com:443

This is the output...is it fine?

CONNECTED(00000003)
depth=1 C = US, O = Symantec Corporation, OU = Symantec Trust Network, CN = Symantec Class 3 Secure Server CA - G4
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
 0 s:/C=US/ST=California/L=San Jose/O=PayPal, Inc./OU=PayPal Production/CN=SHA2-test-api.sandbox.paypal.com
   i:/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 Secure Server CA - G4
 1 s:/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 Secure Server CA - G4
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGlTCCBX2gAwIBAgIQIr0zjsjG4wEyE7U6/TbdkjANBgkqhkiG9w0BAQsFADB+
MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAd
BgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxLzAtBgNVBAMTJlN5bWFudGVj
IENsYXNzIDMgU2VjdXJlIFNlcnZlciBDQSAtIEc0MB4XDTE2MDUyNDAwMDAwMFoX
DTE4MDUyNTIzNTk1OVowgZMxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9y
bmlhMREwDwYDVQQHDAhTYW4gSm9zZTEVMBMGA1UECgwMUGF5UGFsLCBJbmMuMRow
GAYDVQQLDBFQYXlQYWwgUHJvZHVjdGlvbjEpMCcGA1UEAwwgU0hBMi10ZXN0LWFw
aS5zYW5kYm94LnBheXBhbC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQChdpp8j/yvoeq2pwzn5Aq9SV2NccS0daaiNe+QpZB1/Bj05TAco8XYm6GQ
/JG3XAnA9Unf0m4UveU59Q3lU8NzzPSo8rjuUOyMkfbzxitk1RIY97+x2pEtI8P9
q9D0qZ+fXdZXLmjx7gzZCDdiP6N6lcqIeXUFl6KGKkR24Q7JGS5m4dKSBfMcWfmD
iJoXvJmdhijbB02656AJRaoSamoF40dKzBldBVsK92U2PHvtmuUhujuxKT5l/5r9
sAYe5cf9yqUquZKIdHak9HtDUaWzYvOd2JNyB9gT1gMuZt05QevW/FnOlPGsbXyH
A0xrBIHVq0Ov+MUEgNCQSbqe8W6vAgMBAAGjggL3MIIC8zArBgNVHREEJDAigiBT
SEEyLXRlc3QtYXBpLnNhbmRib3gucGF5cGFsLmNvbTAJBgNVHRMEAjAAMA4GA1Ud
DwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwYQYDVR0g
BFowWDBWBgZngQwBAgIwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9kLnN5bWNiLmNv
bS9jcHMwJQYIKwYBBQUHAgIwGQwXaHR0cHM6Ly9kLnN5bWNiLmNvbS9ycGEwHwYD
VR0jBBgwFoAUX2DPYZBV34RDFIpgKrL1evRDGO8wKwYDVR0fBCQwIjAgoB6gHIYa
aHR0cDovL3NzLnN5bWNiLmNvbS9zcy5jcmwwVwYIKwYBBQUHAQEESzBJMB8GCCsG
AQUFBzABhhNodHRwOi8vc3Muc3ltY2QuY29tMCYGCCsGAQUFBzAChhpodHRwOi8v
c3Muc3ltY2IuY29tL3NzLmNydDCCAX4GCisGAQQB1nkCBAIEggFuBIIBagFoAHYA
3esdK3oNT6Ygi4GtgWhwfi6OnQHVXIiNPRHEzbbsvswAAAFU5OcJuAAABAMARzBF
AiAv8/b/8Yyg6BY/DkcOW8Xgd3WUmhPK/HxLf9P8bhmWuQIhAKNBgdZY/NUZx8ww
cbba4YUBYUDoGsHCuhpYQAIY3JbxAHYApLkJkLQYWBSHuxOizGdwCjw1mAT5G9+4
43fNDsgN3BAAAAFU5OcJ0QAABAMARzBFAiEA6cnZYJ9ls2APmlAeGt7+3DYW4vNZ
8ZNsNsGp/LB9RfQCIDMq4bggIGo/u2tCxhkxUUbpj9MCfqueVnGPIIIYQctqAHYA
aPaY+B9kgr46jO65KB1M/HFRXWeT1ETRCmesu09P+8QAAAFU5OcJ1gAABAMARzBF
AiALMmnEbKWb36JmSovA+StKTRqNbBAY6VqlqrnSru4xNAIhANX/puYyAD+CQ7ca
VX0KpvQSVzMpcNXJ1F8fjk0FOn2CMA0GCSqGSIb3DQEBCwUAA4IBAQCUowT7fC4O
LEBWIabeaWwAY1/Ju9ek3khwDpDUHSaPHlpO0L0pVv8zLNoNn1TRdXKPYGpiHTl6
EODCZU1FSCPBSDfEuLSkzH/b6OI7Y208wu5ztdIo+YSjDrB0fa2p85o5S9tyUsh7
PsmX6SwqdxzrCFUnZbYJN7wBcJc6L3tjF/9v4sdy9cWgTjJaYueP1/9aJO8qewRO
QQRgjr1vRM05ZPhw4AvdXPO4BRNhgQZ3M8qeZ07GjLO2AQBah0cBLUJTPyW0LGnU
sAZdNJlakJfuLq3Dbm0VFU5vLmfqVHtfjuBpZiHXwUWIoXBucSMIMs3mRJ8wF0ID
fqq/pgusdsTi
-----END CERTIFICATE-----
subject=/C=US/ST=California/L=San Jose/O=PayPal, Inc./OU=PayPal Production/CN=SHA2-test-api.sandbox.paypal.com
issuer=/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 Secure Server CA - G4
---
Acceptable client certificate CA names
/C=US/ST=California/L=San Jose/O=PayPal, Inc./OU=sandbox_certs/CN=sandbox_camerchapi/emailAddress=re@paypal.com
/C=US/ST=California/L=San Jose/O=PayPal, Inc./OU=stage1_certs/CN=stage1_camerchapi/emailAddress=re@paypal.com
/C=US/ST=CA/L=San Jose/O=PayPal Inc./OU=Mobile Client Certificate Authority/CN=PayPal Sandbox Client CA/emailAddress=DL-PP-ApplicationSecurity@paypal.com
/CN=gtorel_1310486522_per_api1.paypal.com/L=Napoli/ST=Napoli/C=IT
/CN=Sandbox_RootCA/OU=PayPal Crypto Mgt/O=PayPal Inc./L=San Jose/ST=California/C=US
/CN=Sandbox_MerchantIssuingCA/OU=Platform Security/O=PayPal Inc./L=San Jose/ST=California/C=US
---
SSL handshake has read 4176 bytes and written 675 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : AES256-SHA256
    Session-ID: 9E01CD86FA9F510BAD505F17E34C0C9BE824E9A1EE8047E8F2946F8857418F29
    Session-ID-ctx: 
    Master-Key: 20C14118364A3F10503EF4432DE01C382A2F3EF782940DACE906D2294AE7904B44CA04071AA51CCA362D90598D12096C
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1476437590
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---

Here it follows testing curl against https://api-3t.paypal.com/nvp :

curl -I -v https://api-3t.paypal.com/nvp
* About to connect() to api-3t.paypal.com port 443 (#0)
*   Trying 173.0.84.101...
* connected
* Connected to api-3t.paypal.com (173.0.84.101) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs/
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using AES256-SHA256
* Server certificate:
*    subject: C=US; ST=California; L=San Jose; O=PayPal, Inc.; OU=PayPal Production; CN=api-3t.paypal.com
*    start date: 2015-09-11 00:00:00 GMT
*    expire date: 2017-09-10 23:59:59 GMT
*    subjectAltName: api-3t.paypal.com matched
*    issuer: C=US; O=Symantec Corporation; OU=Symantec Trust Network; CN=Symantec Class 3 Secure Server CA - G4
*    SSL certificate verify ok.
> HEAD /nvp HTTP/1.1
> User-Agent: curl/7.28.1
> Host: api-3t.paypal.com
> Accept: */*
> 
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Date: Fri, 14 Oct 2016 11:06:54 GMT
Date: Fri, 14 Oct 2016 11:06:54 GMT
< Server: Apache
Server: Apache
< Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
< Pragma: no-cache
Pragma: no-cache
< Connection: close
Connection: close
< HTTP_X_PP_AZ_LOCATOR: slcb.slc
HTTP_X_PP_AZ_LOCATOR: slcb.slc
< Paypal-Debug-Id: 22cf726847da4
Paypal-Debug-Id: 22cf726847da4
< Set-Cookie: X-PP-SILOVER=name%3DLIVE5.APIT.1%26silo_version%3D880%26app%3Dappdispatcher_apit%26TIME%3D1320943704%26HTTP_X_PP_AZ_LOCATOR%3Dslcb.slc; Expires=Fri, 14 Oct 2016 11:36:54 GMT; domain=.paypal.com; path=/; Secure; HttpOnly
Set-Cookie: X-PP-SILOVER=name%3DLIVE5.APIT.1%26silo_version%3D880%26app%3Dappdispatcher_apit%26TIME%3D1320943704%26HTTP_X_PP_AZ_LOCATOR%3Dslcb.slc; Expires=Fri, 14 Oct 2016 11:36:54 GMT; domain=.paypal.com; path=/; Secure; HttpOnly
< Set-Cookie: X-PP-SILOVER=; Expires=Thu, 01 Jan 1970 00:00:01 GMT
Set-Cookie: X-PP-SILOVER=; Expires=Thu, 01 Jan 1970 00:00:01 GMT
< Content-Length: 146
Content-Length: 146
< Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
< Pragma: no-cache
Pragma: no-cache
< Content-Type: text/plain; charset=utf-8
Content-Type: text/plain; charset=utf-8

< 
* Closing connection #0
* SSLv3, TLS alert, Client hello (1):

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.