Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




1114 posts

Uber Geek
+1 received by user: 66


Topic # 180567 13-Sep-2015 21:42
Send private message

Are there any web developers here that use PayPal's IPN service?

I've been getting emails from PayPal for the last few months saying that they're updating things at their end to support SHA-256 certificates and that I might have to make changes on my websites in order for my PayPal integration to continue to work.

 

I use PayPal's IPN service, which I originally set up on my website (all custom PHP code that I wrote, no pre-built shopping carts) and that has been running quite happily since 2008.

 

My hosting is shared hosting on iServe as it's not a very large or busy website. The hosting platform is running PHP 5.2.17, Apache 2.2.3 (CentOS), and OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 (I got all of this info from PHP's phpinfo() function).

 

Am I correct in thinking that any changes that need to be made will have to be made by my web host (i.e. iServe) since I can't update any software on the server?

 

When I originally set everything up back in 2008 I remember downloading a certificate from PayPal and using OpenSSL on my Windows PC to create something (another certificate? I don't know) which I then uploaded to my website and use for encrypting my payment requests to PayPal. Does the SHA-256 changes that PayPal are bring in affect this? Do I need to remake the certificate or something?

 

I did try using the IPN Simulator (after changing the end points that my IPN handler uses) but I can't get this to work as the IPN Simulator gives me a 502 Bad Gateway error and I've got no idea what that means or what the problem might be.

View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2
BDFL - Memuneh
58325 posts

Uber Geek
+1 received by user: 9774

Administrator
Trusted
Geekzone
Subscriber

  Reply # 1386983 14-Sep-2015 07:43
Send private message

Interesting... We use PayPal IPN for Geekzone Subscriptions and did not receive any email from them...



1114 posts

Uber Geek
+1 received by user: 66


 
 
 
 


BDFL - Memuneh
58325 posts

Uber Geek
+1 received by user: 9774

Administrator
Trusted
Geekzone
Subscriber

  Reply # 1386992 14-Sep-2015 08:03
Send private message

Thanks. Will have to play on the sandbox to test this.

446 posts

Ultimate Geek
+1 received by user: 106

Trusted

  Reply # 1387116 14-Sep-2015 12:13
Send private message

I got this e-mail too and I'm in the same situation.

I have a very limited IPN integration that basically imports all PayPal transactions into a mySQL database via a PHP script.
95% of the code of this script has been copy/pasted from the PayPal IPN website.

I have no idea what to adapt and the PayPal SHA-256 transfer site is very very unclear about what has to be changed.
Certainly no information about the PHP scripts whatsoever.




Gigabit




1114 posts

Uber Geek
+1 received by user: 66


  Reply # 1387126 14-Sep-2015 12:31
Send private message

ScuL: I got this e-mail too and I'm in the same situation.

I have a very limited IPN integration that basically imports all PayPal transactions into a mySQL database via a PHP script.
95% of the code of this script has been copy/pasted from the PayPal IPN website.

I have no idea what to adapt and the PayPal SHA-256 transfer site is very very unclear about what has to be changed.
Certainly no information about the PHP scripts whatsoever.

I've put in a support request to my web host (iServe) to see what they have to say. I'm hoping they'll come back and say that they're aware of the changes PayPal have made and have made the necessary changes at their end to ensure everything carries on working.

446 posts

Ultimate Geek
+1 received by user: 106

Trusted

  Reply # 1387226 14-Sep-2015 14:50
Send private message

I've just had a look at the instructions
https://www.paypal-knowledge.com/resources/sites/PAYPAL/content/live/FAQ/1000/FAQ1766/en_US/2015%20Merchant%20Security%20System%20Upgrade%20Guide%20%28U.S.%20English%29.pdf

They keep going on about certificates but currently I am not using any certificates at all.. my site doesn't even have SSL :D
And the PHP script is working without any issues..

This is the code I am using
https://github.com/paypal/ipn-code-samples/blob/master/paypal_ipn.php




Gigabit




1114 posts

Uber Geek
+1 received by user: 66


  Reply # 1387257 14-Sep-2015 15:07
Send private message

ScuL: I've just had a look at the instructions
https://www.paypal-knowledge.com/resources/sites/PAYPAL/content/live/FAQ/1000/FAQ1766/en_US/2015%20Merchant%20Security%20System%20Upgrade%20Guide%20%28U.S.%20English%29.pdf

They keep going on about certificates but currently I am not using any certificates at all.. my site doesn't even have SSL :D
And the PHP script is working without any issues..

This is the code I am using
https://github.com/paypal/ipn-code-samples/blob/master/paypal_ipn.php

My site doesn't use SSL either, it doesn't need to because all of the credit card entry is done on PayPal's site.

I do encrypt the data that I send to PayPal (i.e. how much to charge, my PayPal ID, etc) but I'm not sure if that's covered by this certificate change or not.

12761 posts

Uber Geek
+1 received by user: 1456


  Reply # 1387264 14-Sep-2015 15:10
Send private message

MurrayM:
ScuL: I got this e-mail too and I'm in the same situation.

I have a very limited IPN integration that basically imports all PayPal transactions into a mySQL database via a PHP script.
95% of the code of this script has been copy/pasted from the PayPal IPN website.

I have no idea what to adapt and the PayPal SHA-256 transfer site is very very unclear about what has to be changed.
Certainly no information about the PHP scripts whatsoever.

I've put in a support request to my web host (iServe) to see what they have to say. I'm hoping they'll come back and say that they're aware of the changes PayPal have made and have made the necessary changes at their end to ensure everything carries on working.


It looks like they have recently setup new servers running php 5.5 which is good. Maybe the new servers support it? I think you can switch it to the new servers by just changing the IP in the DNS zone.



1114 posts

Uber Geek
+1 received by user: 66


  Reply # 1387277 14-Sep-2015 15:42
Send private message

mattwnz: It looks like they have recently setup new servers running php 5.5 which is good. Maybe the new servers support it? I think you can switch it to the new servers by just changing the IP in the DNS zone.


That's good news, thanks for the info. I haven't had a reply back from iServe yet.

Awesome
4754 posts

Uber Geek
+1 received by user: 1038

Trusted
Subscriber

  Reply # 1387349 14-Sep-2015 17:58
Send private message

I got an email with IMMEDIATE ATTENTION REQUIRED in the subject from them overnight on Saturday. Quick search of my emails (I delete nothing) shows this is the first notice I have received of the change, despite the email starting with "As we have previously communicated to you".

I'm running a pretty basic site on WordPress/WooCommerce and very confused about what I need to do here.




Twitter: ajobbins


BDFL - Memuneh
58325 posts

Uber Geek
+1 received by user: 9774

Administrator
Trusted
Geekzone
Subscriber

  Reply # 1387350 14-Sep-2015 18:01
Send private message

I am confused too. We have two sites: one uses SSL the other doesn't. Both work just fine.


Awesome
4754 posts

Uber Geek
+1 received by user: 1038

Trusted
Subscriber

  Reply # 1387368 14-Sep-2015 18:23
One person supports this post
Send private message

This is a monumental screw up on PayPals part. Clearly they haven't communicated with everyone even now, and all the info out there is completely unclear about what we need to do.




Twitter: ajobbins


457 posts

Ultimate Geek
+1 received by user: 83


  Reply # 1387471 14-Sep-2015 20:28
Send private message

A little bit off topic, but I can't believe someone would still be offering PHP 5.2 hosting, it was EOL'ed more than 4 years ago.

446 posts

Ultimate Geek
+1 received by user: 106

Trusted

  Reply # 1388410 16-Sep-2015 09:59
Send private message

I've been told this may only be a change on the PayPal server side and all you need to ensure is that the client supports the SHA-256 algorithm.
I am still unsure.




Gigabit


446 posts

Ultimate Geek
+1 received by user: 106

Trusted

  Reply # 1398345 1-Oct-2015 23:20
Send private message

Well, it's the 1st of October now and everything is still working..




Gigabit


 1 | 2
View this topic in a long page with up to 500 replies per page Create new topic



Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Nothing nebulous about Microsoft’s cloud-transition
Posted 21-Jul-2017 15:34


We’re spending more on tech, but not as much as Australians
Posted 21-Jul-2017 11:43


Endace announces EndaceFabric for network-wide packet recording
Posted 20-Jul-2017 20:49


Acorn 6: MacOS image editing for the rest of us
Posted 20-Jul-2017 17:04


HTC faces backlash over keyboard pop-up ads
Posted 19-Jul-2017 15:53


BNZ adds Visa credit cards to Android Pay wallet
Posted 18-Jul-2017 19:44


Still living in a Notification hell – Om Malik
Posted 18-Jul-2017 13:00


Duet Display uses iPad to extend Mac, PC
Posted 18-Jul-2017 10:58


PC sales could be worse
Posted 17-Jul-2017 07:34


Crypto-currencies, tulips, market bubbles
Posted 17-Jul-2017 06:38


NZ Tech Podcast: Big batteries, solar cars, cold war, IoT
Posted 16-Jul-2017 16:53


Vodafone Australia mulls Wisp alliance, NZ implications
Posted 13-Jul-2017 16:49


Rural health professionals see fibre pay-off
Posted 13-Jul-2017 11:52


Vodafone announces expansion of $5 Daily Roaming
Posted 13-Jul-2017 10:20


Intel unveils powerful Intel Xeon Scalable processors
Posted 12-Jul-2017 20:41



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.