21

I'm receiving warning emails from PayPal that they are making root certificate changes for SSL connections for Instant Payment Notifications (IPN).

They are making a number of changes including changing from Verisign G2 (1024-bit) to G5 (2048-bit) certificates and changing from an SHA-1 to SHA-256 hashes.

I'm not sure what actions are necessary by me to remain compatible with PayPal integration.

  1. do I need to contact my hosting provider to explore what changes might be needed in my environment, including possible PHP versions and trusted certificate stores?

  2. since it appears that PayPal integration for Magento is 'built-in' (not an extension) will there be necessary patches to remain compatible with PayPal?

Thanks!

Improve this question
10

There seem to be quite a some confusion as a result of the email by PayPal.

What they basically means is that PayPal IPN will only work with websites with SSL Certificates that are using 2048-bit and also SHA-256.

2048-bit should now be standardized for all SSL Certificates so it shouldn't be a problem.

SHA-256 is something that you need to take note of as your SSL Certificate may still be running the older SHA-1 cryptographic hash algorithm.

You can check if your SSL Certificate is using SHA-1 or SHA-256 at this website: https://shaaaaaaaaaaaaa.com/

If you are still using SHA-1, you will need to contact your SSL Certificate issuer (not your hosting provider) to reissue the SSL Certificate into SHA-256 and install it in your server to replace the SHA-1 SSL Certificate.

Improve this answer
7
  • 2
    This is about PayPal's server certificate, not my domain's server certificate. i think I need to be sure that PHP connections from my server supports both PayPal's new Verisign G5 signed certificate and SHA-256. – MarkE Sep 11 '15 at 15:26
  • 2
    No, you must have misunderstood. This is about your own SSL Certificate. PayPal IPN will stop talking to any merchant's SSL Certificates which are not using at least 2048-bit and SHA-256. – Aspiration Hosting Sep 12 '15 at 9:22
  • But until now you didn't need any certificate, it worked even without SSL. So I guess this thing is not about merchant's SSL Certificate because we didn't need any certificate before. Otherwise they would mention that from now we will need SSL, but no they didn't mention that, they just mentioned they will upgrade to SHA-256. – JohnyFree Sep 17 '15 at 18:47
  • @AspirationHosting update to my previous comment: In their e-mail is wrote: Testing in the Sandbox is one of the best ways to make sure your integration works. Sandbox endpoints have been upgraded to accept secure connections by the SHA-256 Certificates.. I tested my website with sandbox and it put successfully Complete status which means IPN works even if my website doesn't have SSL Certificate. So I think this answer is correct. – JohnyFree Sep 21 '15 at 15:50
  • @JohnyFree PayPal have stated that if you do not have any SSL Certificate, the announcement does not apply to you and you can continue receiving IPN as usual. If you use a SSL Certificate, you need to make sure that it is at least 2048-bit and SHA-256. I believe the reason they do this is because when you have a SSL but insecure, you will give end users a false sense of security but if you do not use any SSL at all, your end users doesn't "feel secure" in the first place so the point is moot. – Aspiration Hosting Sep 27 '15 at 10:36
2

You can also check it on your server by running

openssl s_client -connect api-3t.sandbox.paypal.com:443 -showcerts | egrep -wi "G5|return"

In that output, you will want to note the presence of two specific items:

A Certification Authority containing “G5”. Note that you may see several CA lines in your output; as long as G5 is included, your server is compliant. A Verify return code of “0 (ok)”.

If both are present, your server is compliant and no further action needs to be taken.

Creds go to liquidweb

Improve this answer
1

Full information from paypal security upgrade pdf (more languages here).

On Linux, you can check for Verisign's G5 root certificate using this shell script.

On windows, the method is bit different, you can check here.

If the system has the G5 root certificate, no further action is needed.

Improve this answer
1

This is what I have done to check if my systems are ready for this certificate change:

On my debian box hosting Magento, go to /etc/ssl/certs to look for the root certificat required by paypal. I found there: VeriSign_Class_3_Public_Primary_Certification_Authority_-_G5.pem => good.

  • I passed an order on my test environment which is linked to the paypal sandbox, and paid on using a test credit card (see getcreditcardnumbers.com to have one). => good.
  • In the Mangento backoffice, Menu sales > orders > view the order. In the Comments history, I could see IPN completed, with the transaction ID from paypal. => good.
  • I opened /var/www/[myshop]/var/log/payment_hosted_pro.log on the debian box hosting magento to see if there were any error or warning. => all good. And I noticed the postback link ([postback_to] => www.sandbox.paypal.com/cgi-bin/webscr)
  • I used the link you provided to check what was the algorithm used for that URL: https://shaaaaaaaaaaaaa.com/check/www.sandbox.paypal.com => Good. While for the production site, it is https://shaaaaaaaaaaaaa.com/check/www.paypal.com => bad. So on my test environnement which is very similar to the one on production, everything is fine with the certificat used in the sandbox by paypal. So, when paypal will changed its certificat for its site, mine should still be able to receive IPN.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.