M1 - TLS 1.2 - PayPal Express NVP CURL connection error #35: SSL connect error

Question

I have a dev environment on an old sever running curl 7.19.7.

Recently I've noticed that Paypal Express no longer works and is returning an error "Unable to communicate with the PayPal gateway.".

Digging into the exception logs you can see

exception 'Exception' with message 'PayPal NVP CURL connection error #35: SSL connect error' in /path/app/code/core/Mage/Paypal/Model/Api/Nvp.php:983
Stack trace:
#0 /path/app/code/core/Mage/Paypal/Model/Api/Nvp.php(616): Mage_Paypal_Model_Api_Nvp->call('SetExpressCheck...', Array)
#1 /path/app/code/core/Mage/Paypal/Model/Express/Checkout.php(381): Mage_Paypal_Model_Api_Nvp->callSetExpressCheckout()
#2 /path/app/code/core/Mage/Paypal/Controller/Express/Abstract.php(108): Mage_Paypal_Model_Express_Checkout->start('http://asdf...', 'http://asdf...', false)
#3 /path/app/code/core/Mage/Core/Controller/Varien/Action.php(418): Mage_Paypal_Controller_Express_Abstract->startAction()
#4 /path/app/code/core/Mage/Core/Controller/Varien/Router/Standard.php(254): Mage_Core_Controller_Varien_Action->dispatch('start')
#5 /path/app/code/core/Mage/Core/Controller/Varien/Front.php(172): Mage_Core_Controller_Varien_Router_Standard->match(Object(Mage_Core_Controller_Request_Http))
#6 /path/app/code/core/Mage/Core/Model/App.php(365): Mage_Core_Controller_Varien_Front->dispatch()
#7 /path/app/Mage.php(684): Mage_Core_Model_App->run(Array)
#8 /path/index.php(210): Mage::run('uk', 'store')

I don't know if Paypal have changed anything with their sandbox recently, but went to the api-3t.sandbox.paypal.com URL on SSLLabs and saw that the only protocol they support is TLS 1.2.

After reading up on setting protocol versions in the PHP manual I hackily added the following

nano +194 lib/Varien/Http/Adapter/Curl.php

curl_setopt_array($this->_getResource(), $options);

+curl_setopt($this->_getResource(), CURLOPT_SSLVERSION, 6);

return $body;

Great! After an apache graceful I can now use Paypal express. However, I am not happy that I've had to hack the core. I'm also not happy that I've had to hack the core in a place specific to curl rather than to Paypal.

Does anyone have any advice on a correct way to fix this issue?

EDIT:

Just confirming some extra findings, this does not affect Paypal Standard in Magento as it does not appear to use curl under the hood. We were getting false negatives on certain machines.

Q: "How can this possibly be working! curl fails to connect to the sandbox on the command line"

A: "It's using paypal standard and not express, it doesn't use curl

Answer 1

We had this same problem and just fixed it by updating the curl library from 7.19 to 7.40..

Run the following command: curl -v -s https://api-3t.sandbox.paypal.com/nvp

If you get an SSL Connect error you have same problem we had.

You can use the following link (response #3) for instructions on how to do this curl library update: https://stackoverflow.com/questions/28495444/how-to-upgrade-php-curl-to-version-7-36-0

We also tried a hack and it worked but we were not happy with a temporary solution.

I hope this information helps you out.

Answer 2

I also encountered this error today. Adding the following to app/code/core/Mage/Paypal/Model/Api/Nvp.php around line 945 is at least making the change in the Paypal Nvp module instead of the libraries.

 try {
        $http = new Varien_Http_Adapter_Curl();

+       $http->addOptions(array(CURLOPT_SSLVERSION => 6));

According to the curl constants manual page, you can also use the constant CURL_SSLVERSION_TLSv1_2 instead of 6 if you have a PHP version >= 5.5.19 or 5.6.3.

Answer 3

The sandbox did indeed change in the past week to only accept TLS 1.2. From my tests, TLS 1.2 will kick in automatically if you're using PHP 5.5.19+ and a sufficiently recent curl version (I'm using 7.29). You also need OpenSSL 1.0.1+.

Since we're still running 5.3 we've had to add the same hack to the core as well, but since Magento still claim support for 5.3 we can probably expect an official solution soon (especially since these changes will also hit Paypal production systems in June).

Reference: https://devblog.paypal.com/upcoming-security-changes-notice/