WordPress.org

Ready to get started?Download WordPress

Forums

SSL Error while verifying Paypal IPN (10 posts)

  1. Mike
    Member
    Posted 3 years ago #

    Hello.

    I am using the Paypal Framework plugin (http://wordpress.org/extend/plugins/paypal-framework/) and am receiving the following error when it tries to verify the IPN request sent by Paypal:

    SSL certificate problem, verify that the CA cert is OK. Details:
    error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

    I have tried setting the following wherever I believe it is about to make a curl request:

    curl_setopt( $handle, CURLOPT_SSL_VERIFYHOST, false );
    curl_setopt( $handle, CURLOPT_SSL_VERIFYPEER, false );

    (just for testing purposes, I wouldn't do this in production). But the exact same error still occurs.

    I've been googling this for a few hours now, and none of the methods suggested appear to be working to even find where it is that the problem is occurring. Unfortunately, the plugin author does not appear to be active anymore (the last forum posts are 2010, with no replies) and he hasn't updated this since 2010.

    I am currently testing it with Paypal Sandbox, and when I visit the page that it is attempting to verify, Firefox informs me that its a proper certificate. Aside from this, everything else with the IPN appears to be working properly. If its of any value to anyone, I am currently hosted by GoDaddy.

    Any input or help would be much appreciated.

    Thank you in advance!

  2. truckeetrout
    Member
    Posted 2 years ago #

    Same problem here. Did you ever find a solution?

    George

  3. Mike
    Member
    Posted 2 years ago #

    This was a while ago. If I remember Correctly, the hosting provider did not have the standard certificate authorities installed and therefor curl cannot verify that certificate is correct.

    The solution is either to download the certificate for the root CA that signed te certificate in question, or link to a bundle of CA certificates. I did the bundle. you link to it within your php code. As for linking to the bundle, you need to do it somewhere within the WordPress source, in the bit that does remote connections.

    I can't remember where I found it, but you might find it in a google search. If I get a chance this week I'll post something on my blog and put a link here.

    Hope that helps,
    Mike

  4. truckeetrout
    Member
    Posted 2 years ago #

    Thanks for the v. fast reply. It's no wonder I get the failure - I'm working on a development system (my laptop) that has no notion of CA certificates. So I guess I next need to figure out how to get some.

    Thanks again.

    George

  5. truckeetrout
    Member
    Posted 2 years ago #

    Hope you find the time for some archaeology.

    I've progressed from "SSL3_GET_SERVER_CERTIFICATE:certificate verify failed" to "SSL timeout". And then hit a wall.

    g

  6. Mike
    Member
    Posted 2 years ago #

    To clarify, are you using the PayPal Framework plugin?

  7. truckeetrout
    Member
    Posted 2 years ago #

    Yes; v 1.0.8. In a terse exchange of e-mails with the author it was suggested I've got an out-of-date CA certificate. Thought I'd added the current sandbox cert to a bundle from the cUrl site.

    I need to learn more about the workings of SSL & the listener code to understand where the timeout comes from. Gotta love those steep learning curves.

    g

  8. Mike
    Member
    Posted 2 years ago #

    Hi George,

    So this is what I think I did:

    I created a folder within the paypal-framework plugin directory called 'CACERTS'. To this folder I added a couple certificates including (majorly) this one:http://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1

    This certificate is the stock CA's included in Firefox (straight from mozilla to boot!)

    I then added the following lines to the paypal-framework.php file at the very start of the '_validateMessage()' function: (ensure to replace '<---------------Name of Certificate file------------------>' with the filename of the certificates you want.

    $ch = curl_init();
                    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
                    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
                    $_POST['cares'] = curl_setopt($ch, CURLOPT_CAINFO, dirname(__FILE__) . "/CAcerts/<---------------Name of Certificate file------------------>");
                    $_POST['caurl'] = dirname(__FILE__) . "/CAcerts/<---------------Name of Certificate file------------------>";
    		// Set the command that is used to validate the message
    		$_POST['cmd'] = "_notify-validate";

    Like I said, I really don't remember a whole lot about this, except for having to do ALOT to get this working.. I checked my old copy of WP and I don't think I had to modify the source to get this to work. Let me know if it works for you though... Also note that I did this using V1.06 of paypal-framework and 3.1 of WordPress, so something may have changed with the versions.

    Hope this helps.
    Mike

  9. truckeetrout
    Member
    Posted 2 years ago #

    Mike,

    Thanks immensely for taking the time to dig into this. I'll certainly try this out and let you know what happens.

    I'm still getting the timeout and have sunk to looking at packet traces to see if I can learn anything. I've got a post up at a PayPal forum, one here at WPville, and an e-mail in to the plugin author. Somewhere there's gotta be an answer.

    Fingers crossed.

    George

  10. truckeetrout
    Member
    Posted 2 years ago #

    Mike,

    Looks like the world has spun around a few times since v1.06. All of the cUrl functionality is now in class-http.php. The _validateMessage() function calls wp_remote_post with a url and a parameter array. While I've been known to hack a few lines of code, this is terra incognito for me. So while I'm glad your hack works for you, I'm outta my depth trying to apply it here.

    I've totally given up on making this IPN work. I'm recommending to my client that they look at options other than plugins to accomplish their goals.

    I very much appreciate your efforts on my behalf. Best regards.

    George

Topic Closed

This topic has been closed to new replies.

About this Topic