8

PayPal is upgrading their certificate and require that people's certificates are also upgraded. Copying the notice below.

But IPN can currently be used without a certificate. Does anyone know if that will not be allowed in future? Or if the older certificates will not work but non-ssl connections will continue to work?

I know it's advisable to have SSL... But some sites want to avoid having SSL and that's why they use PayPal, to avoid asking for credit card information on their site.

PayPal email:

As we have previously communicated to you, PayPal is upgrading the certificate for www.paypal.com to SHA-256. This endpoint is also used by merchants using the Instant Payment Notification (IPN) product.

This upgrade is scheduled for 9/30/2015; however, we may need to change this date on short notice to you to align to the industry security standard.

You’re receiving this notification because you’ve been identified as a merchant who has used IPN endpoints within the past year. If you have not made the necessary changes, we urge you to do so right away to avoid a disruption of your service!

https://www.paypal-community.com/t5/About-Business/PayPal-Endpoint-certificate-upgrade-SHA-256-encryption/m-p/997455#U997455

Merchants using PayPal Instant Payment Notifications (IPN) may be impacted by the change if their web server is not enabled for SHA-256 compliance. If you are using a 3rd party solution for order management and for integrating PayPal on your website, you may be using IPN. Please check with your shopping cart provider to see if you are affected.

and

If you are a merchant who uses IPN with PayPal, your server will need to be upgraded to support SHA-256. Please contact your web host or the checkout partner providing the integration solution to ensure SHA-256 is enabled for the server.

  • Added some additional quotes from PayPal docs. If PayPal are not permitting IPN over HTTP, they should reject attempts to set HTTP IPN URLs - so you may be able to confirm that in your PayPal account settings? The above excerpts do seem to suggest HTTP IPN is not supported, but I'd be surprised if that was the case; it'd be a big change ... – Chris Burgess Sep 11 '15 at 22:44
  • developer.paypal.com/developer/ipnSimulator currently permits IPN over HTTP as well as HTTPs. – Chris Burgess Sep 12 '15 at 3:10
  • I have make some test on the IPN at this link: developer.paypal.com/developer/ipnSimulator The result was: "IPN was sent and the handshake was verified." I am ok with my IPN, for SHA - 256 update ? – edgar Sep 24 '15 at 15:32
7

No, PayPal state that SSL will not required for IPN. I contacted PayPal MTS to confirm and got the responses below:

email reply from paypal MTS

forum reply from paypal_frank


PayPal seem to be saying

  • if you have SSL yourself, your certificate and its chain need SHA-256 not SHA-1 both for PayPal and modern browser support,
  • when you connect to their server, your webserver must accommodate their SHA-256 certificate. Most hosting environments will be fine, but older envs lacking SHA-256 support in SSL libs won't.

PayPals docs are a bit unclear (hence your question!), but they seem to be stating certificates must be SHA-256 rather than all sites require a certificate. In particular the graphic at top of 2015-2016 SSL Cert Change Microsite) can confuse since it says "must be running a SHA-256 compliant server".

PayPal IPN microsite banner

My assessment, based on the following (later confirmed via PayPal MTS), is that non-SSL IPN will still be supported. Rationale:

  • Requiring SSL for all sites would be a big business change; it would kill IPN on a lot of small orgs who don't have the $$ for SSL hosting.
  • PayPal's IPN simulator does not validate the protocol for SSL. If this was a requirement, they would implement it in their simulator.
  • PayPal's IPN simulator works using plain HTTP, fails when using SSL to a SHA-1 cert site, and works when using SSL to a SHA-256 cert site.
  • PayPal's docs refer to "SHA-256 compliance" and seem to say "require SHA-256 compliant cert" rather than "require a cert".

I've submitted a support question & asked PayPal on Twitter (1, 2). Will update if we get a canonical YES or NO - we have multiple clients asking the same.

Update: Initial responses (reply from MTS, Twitter) are that HTTP IPN will be a supported use case after SHA256 rollout.

Update 2: PayPal Merchant Technical Services have replied that IPN over plain HTTP can be supported once 2015-2016 SSL migration completes. Answer updated.

Update 3: Adding confirmation from @PayPal_Frank in a paypal-community.com forum question


All that said - I recommend that ALL organisations using CiviCRM should SSL their traffic for contact privacy. Read Joe Murray's post on the CiviCRM blog and consider your contact's privacy - SSL is inexpensive and helps build trust; it'll probably pay off for your org.

  • Chris, PayPal sent out a notice today to clients who specifically use the IPN functionality which is for completed transaction information being sent from PP to the clients webserver. This secure connection will need to use SHA-256 or PP will abort the transmission. – DaveD - BackOffice Thinking Sep 11 '15 at 22:12
  • Thanks Dave. That does make sense - perhaps IPN is supported over plain HTTP, but not over less-secure HTTPs configs for sites which do use SSL. I don't see any specific mention that IPN requires SSL on PayPal's integration guide, but docs can be wrong. Also, related discussion on wordpress.org. – Chris Burgess Sep 11 '15 at 22:29
  • Also, as Dave suggests: SSL all the things, it's just good sense. CiviCRM contacts deserve privacy, and not just for transaction data. IMO using CiviCRM without SSL is playing fast and lose with privacy. – Chris Burgess Sep 11 '15 at 22:34
  • I've updated this answer from my original reply. – Chris Burgess Sep 13 '15 at 22:29
  • Got a firm reply from PayPal MTS, answer updated above. – Chris Burgess Sep 14 '15 at 8:04
1

You probably need to pose this question directly to PayPal. It's really a matter of whether they will require a secure connection going forward. It could be that they will force it.

It also may depend upon your host. One client of mine is hosted on HostGator and they too do not have an SSL cert, however in its absence the HostGator SSL cert takes over (and it has SHA-256 encryption). The best way to check this is to go to your site using HTTPS and see if a cert is presented, and if so, you can see whose cert it is and if it has the proper encryption.

As you said it is advisable to have an SSL, and these days, it really is a no-brainer that you should have one. The price for a basic cert is dirt cheap; I usually can get one for $30/yr. Highly recommended.

  • Asked @AskPayPal: twitter.com/xurizaemon/status/642466912979447808 – Chris Burgess Sep 11 '15 at 22:37
  • the image at the top of their SSL cert microsite does seem to say you'll need SSL for IPN now. – Chris Burgess Sep 11 '15 at 22:47
  • PayPal's communication concerns the client SSL/TLS connection back to www.paypal.com (for the IPN message validation). There will be no impact on IPN message delivery to merchant servers and/or CivicCRM installations. – Robert Sep 14 '15 at 16:53
  • 1
    @Robert, please refer to my answer (or Twitter conver), as there is impact (confirmed by PayPal reps) if you are using IPN to merchant server and the merchant server uses SSL with SHA-1 cert. – Chris Burgess Sep 16 '15 at 0:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.