What actions are necessary for PayPal's announced certificate changes?

Question

I'm receiving warning emails from PayPal that they are making root certificate changes for SSL connections for Instant Payment Notifications (IPN).

They are making a number of changes including changing from Verisign G2 (1024-bit) to G5 (2048-bit) certificates and changing from an SHA-1 to SHA-256 hashes.

I'm not sure what actions are necessary by me to remain compatible with PayPal integration.

1. do I need to contact my hosting provider to explore what changes might be needed in my environment, including possible PHP versions and trusted certificate stores?

2. since it appears that PayPal integration for Magento is 'built-in' (not an extension) will there be necessary patches to remain compatible with PayPal?

Thanks!

Answer 1

There seem to be quite a some confusion as a result of the email by PayPal.

What they basically means is that PayPal IPN will only work with websites with SSL Certificates that are using 2048-bit and also SHA-256.

2048-bit should now be standardized for all SSL Certificates so it shouldn't be a problem.

SHA-256 is something that you need to take note of as your SSL Certificate may still be running the older SHA-1 cryptographic hash algorithm.

You can check if your SSL Certificate is using SHA-1 or SHA-256 at this website: https://shaaaaaaaaaaaaa.com/

If you are still using SHA-1, you will need to contact your SSL Certificate issuer (not your hosting provider) to reissue the SSL Certificate into SHA-256 and install it in your server to replace the SHA-1 SSL Certificate.

Answer 2

You can also check it on your server by running

openssl s_client -connect api-3t.sandbox.paypal.com:443 -showcerts | egrep -wi "G5|return"

In that output, you will want to note the presence of two specific items:

A Certification Authority containing “G5”. Note that you may see several CA lines in your output; as long as G5 is included, your server is compliant. A Verify return code of “0 (ok)”.

If both are present, your server is compliant and no further action needs to be taken.

Creds go to liquidweb

Answer 3

Full information from paypal security upgrade pdf (more languages here).

On Linux, you can check for Verisign's G5 root certificate using this shell script.

On windows, the method is bit different, you can check here.

If the system has the G5 root certificate, no further action is needed.

Answer 4

This is what I have done to check if my systems are ready for this certificate change:

On my debian box hosting Magento, go to /etc/ssl/certs to look for the root certificat required by paypal. I found there: VeriSign_Class_3_Public_Primary_Certification_Authority_-_G5.pem => good.

• I passed an order on my test environment which is linked to the paypal sandbox, and paid on using a test credit card (see getcreditcardnumbers.com to have one). => good.
• In the Mangento backoffice, Menu sales > orders > view the order. In the Comments history, I could see IPN completed, with the transaction ID from paypal. => good.
• I opened /var/www/[myshop]/var/log/payment_hosted_pro.log on the debian box hosting magento to see if there were any error or warning. => all good. And I noticed the postback link ([postback_to] => www.sandbox.paypal.com/cgi-bin/webscr)
• I used the link you provided to check what was the algorithm used for that URL: https://shaaaaaaaaaaaaa.com/check/www.sandbox.paypal.com => Good. While for the production site, it is https://shaaaaaaaaaaaaa.com/check/www.paypal.com => bad. So on my test environnement which is very similar to the one on production, everything is fine with the certificat used in the sandbox by paypal. So, when paypal will changed its certificat for its site, mine should still be able to receive IPN.