paypal/PayPal-PHP-SDK

REST calls to Sandbox fail with SSL connect error on RHEL 6 without TLSv1.2

omarkilani opened this issue · 11 comments

omarkilani commented

Hey PayPal,

I'm unable to connect to api.sandbox.paypal.com without setting:

CURLOPT_SSLVERSION => 6

(Instead of 1 as it currently is)

api.paypal.com works fine.

Is this a known issue?

tobeorla commented

This is happening to me too.
Having: {"paypal/rest-api-sdk-php" : "v1.6.3",}

I forked this SDK yesterday and it was working fine. Now it doesn't :S
P.S: Applying @omarkilani change on PayPalHttpConfig.php works..

randstraw commented

https://www.paypal-knowledge.com/infocenter/index?page=content&id=FAQ1914&expand=true&locale=en_US

After January 19-20
The Sandbox endpoints will only allow TLS 1.2 and HTTP/1.1 connections

tobeorla commented

Thanks for the info @pp-randy , what should we do? I ran the test and says it's ok:

  1. SUCCESS: Your server supports TLS protocols required for secure connection to PayPal Servers.
  • Current Curl Version: 7.22.0
  • Current OpenSSL Version:OpenSSL/1.0.1
juwlee commented

@tobeorla please see here. You might need to upgrade your openssl, curl, and re-link or recompile php so it could use openssl that supports TLS 1.2

  • 👍1
tobeorla commented

I don't think so:
PayPal_Connection_OKbool(true)

jaypatel512 commented

I will accept the PR from @tobeorla and make a release with minor version. Updating your SDK should solve your issue. However, if for any reason, you are not ready to make the change, and want to enable PayPal again, you can follow the step shown in sample/bootstrap.php.

Adding below lines to your bootstrap location, before making a call should allow you to override the default curl options in the SDK. Optionally, you can do the same if you are using sdk_config.ini.

PayPalHttpConfig::$defaultCurlOptions[CURLOPT_SSLVERSION] = CURL_SSLVERSION_TLSv1_2;

Above code should automatically update the curl version to TLSv1.2 which is now required for sandbox.

jaypatel512 commented

Made a release v1.6.4 with proper fix.

kenjohnson commented

@jaypatel512,
I don't think this fix will work for everyone.
The fix will update curl okay, but that won't help
if the user is running openssl that is below NSS 3.15.
See my comments on the following issue.
PAY request returns SSL connect error paypal/adaptivepayments-sdk-php#64
Those people running openssl below NSS 3.15 are in real trouble now.

kenjohnson commented

@jaypatel512, @juwlee,@pp-randy
We upgraded our openssl to OpenSSL/1.0.1,
and that solved the problem, like @juwlee
suggested. Now we can make payment.
Thanks.

mahmoudgabrweb commented

Hi,
i have a problem in paypal on server ... it works in localhost but doesn't work on the server
error message :
error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure'

xiaoleih41 commented

@MhmudHsham I am locking this conversation, please open a new issue with your debug Id.