I have a dev environment on an old sever running curl 7.19.7.

Recently I've noticed that Paypal Express no longer works and is returning an error "Unable to communicate with the PayPal gateway.".

Digging into the exception logs you can see

exception 'Exception' with message 'PayPal NVP CURL connection error #35: SSL connect error' in /path/app/code/core/Mage/Paypal/Model/Api/Nvp.php:983
Stack trace:
#0 /path/app/code/core/Mage/Paypal/Model/Api/Nvp.php(616): Mage_Paypal_Model_Api_Nvp->call('SetExpressCheck...', Array)
#1 /path/app/code/core/Mage/Paypal/Model/Express/Checkout.php(381): Mage_Paypal_Model_Api_Nvp->callSetExpressCheckout()
#2 /path/app/code/core/Mage/Paypal/Controller/Express/Abstract.php(108): Mage_Paypal_Model_Express_Checkout->start('http://asdf...', 'http://asdf...', false)
#3 /path/app/code/core/Mage/Core/Controller/Varien/Action.php(418): Mage_Paypal_Controller_Express_Abstract->startAction()
#4 /path/app/code/core/Mage/Core/Controller/Varien/Router/Standard.php(254): Mage_Core_Controller_Varien_Action->dispatch('start')
#5 /path/app/code/core/Mage/Core/Controller/Varien/Front.php(172): Mage_Core_Controller_Varien_Router_Standard->match(Object(Mage_Core_Controller_Request_Http))
#6 /path/app/code/core/Mage/Core/Model/App.php(365): Mage_Core_Controller_Varien_Front->dispatch()
#7 /path/app/Mage.php(684): Mage_Core_Model_App->run(Array)
#8 /path/index.php(210): Mage::run('uk', 'store')

I don't know if Paypal have changed anything with their sandbox recently, but went to the api-3t.sandbox.paypal.com URL on SSLLabs and saw that the only protocol they support is TLS 1.2.

After reading up on setting protocol versions in the PHP manual I hackily added the following

nano +194 lib/Varien/Http/Adapter/Curl.php

curl_setopt_array($this->_getResource(), $options);

+curl_setopt($this->_getResource(), CURLOPT_SSLVERSION, 6);

return $body;

Great! After an apache graceful I can now use Paypal express. However, I am not happy that I've had to hack the core. I'm also not happy that I've had to hack the core in a place specific to curl rather than to Paypal.

Does anyone have any advice on a correct way to fix this issue?

EDIT:

Just confirming some extra findings, this does not affect Paypal Standard in Magento as it does not appear to use curl under the hood. We were getting false negatives on certain machines.

Q: "How can this possibly be working! curl fails to connect to the sandbox on the command line"

A: "It's using paypal standard and not express, it doesn't use curl

  • Old dead curls... PHP will be the next issue. Upgrade the OS on the server. Get VirtualBox and run VMs, it's a lot easier that way. TLS is moving on. – Fiasco Labs Jan 29 '16 at 2:46
up vote 9 down vote accepted

We had this same problem and just fixed it by updating the curl library from 7.19 to 7.40..

Run the following command: curl -v -s https://api-3t.sandbox.paypal.com/nvp

If you get an SSL Connect error you have same problem we had.

You can use the following link (response #3) for instructions on how to do this curl library update: https://stackoverflow.com/questions/28495444/how-to-upgrade-php-curl-to-version-7-36-0

We also tried a hack and it worked but we were not happy with a temporary solution.

I hope this information helps you out.

  • 1
    After a bit of head scratching we remembered to restart PHP fpm and then it all started working :) Thanks. Upgrading curl is all that was required. – Luke Rodgers Jan 29 '16 at 11:15
  • Any workaround available for shared hosting? – Raks Apr 2 '16 at 9:50

I also encountered this error today. Adding the following to app/code/core/Mage/Paypal/Model/Api/Nvp.php around line 945 is at least making the change in the Paypal Nvp module instead of the libraries.

 try {
        $http = new Varien_Http_Adapter_Curl();

+       $http->addOptions(array(CURLOPT_SSLVERSION => 6));

According to the curl constants manual page, you can also use the constant CURL_SSLVERSION_TLSv1_2 instead of 6 if you have a PHP version >= 5.5.19 or 5.6.3.

  • Thanks for posting this more paypal specific hack! After reviewing the other answers we solved the problem by upgrading curl. Thankfully we were running a modern enough version of php for this to work :) – Luke Rodgers Jan 29 '16 at 11:17
  • Great answer, just don't edit core files. I like the constant reference too! – Robbie Averill Feb 2 '16 at 18:35

The sandbox did indeed change in the past week to only accept TLS 1.2. From my tests, TLS 1.2 will kick in automatically if you're using PHP 5.5.19+ and a sufficiently recent curl version (I'm using 7.29). You also need OpenSSL 1.0.1+.

Since we're still running 5.3 we've had to add the same hack to the core as well, but since Magento still claim support for 5.3 we can probably expect an official solution soon (especially since these changes will also hit Paypal production systems in June).

Reference: https://devblog.paypal.com/upcoming-security-changes-notice/

  • Thankfully the server was running php 5.5.24, so upgrading curl was all that was required. – Luke Rodgers Jan 29 '16 at 11:16

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.