贝宝IPN侦听器-SSL证书握手失败

Question

Running PHP 5.3.28 and curl 7.30.0 (OpenSSL/0.9.8y & libssh2/1.4.2) on Windows Server 2008 R2 using IIS.

I'm creating a IPN listener for PayPal Instant Payment Notifications using their sandbox environment, but no matter what I do I get SSL certificate errors like:

error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

Here is my code (where $fields are the correct fields to POST back):

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://www.sandbox.paypal.com/cgi-bin/webscr';
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FAILONERROR, true);
if ($result = curl_exec($ch)) {
    echo 'result = '.$result.'<br>';
} else {
    echo 'result = '.$result.'<br>';
    echo 'errno = '.curl_errno($ch).'<br>';
    echo 'error = '.curl_error($ch).'<br>';
}
curl_close($ch);

So, I understand that the PayPal server requires TLS 1.2 and does not support SSL 2/3 , but I can't seem to get my POST request to work. I've tried:

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

...and I get the same error. I've also tried:

curl_setopt($ch, CURLOPT_SSLVERSION, n);

...which gets these results:

• [default] = 35 error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
• 0 CURL_SSLVERSION_DEFAULT = 35 error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
• 1 CURL_SSLVERSION_TLSv1 = 35 error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure
• 2 CURL_SSLVERSION_SSLv2 = 4 OpenSSL was built without SSLv2 support
• 3 CURL_SSLVERSION_SSLv3 = 35 error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure
• 4 CURL_SSLVERSION_TLSv1_0 = 35 error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
• 5 CURL_SSLVERSION_TLSv1_1 = 35 error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
• 6 CURL_SSLVERSION_TLSv1_2 = 35 error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

I also read somewhere to try this:

curl_setopt($ch, CURLOPT_CAINFO, dirname(__FILE__) . '\\cacert.pem');

Where cacert.pem is downloaded from http://curl.haxx.se/docs/caextract.html and placed in the same directory as my script. This doesn't make any difference.

Is my code correct..?

How do I make this work..?

Answer 1

I have this working now, here's how:

1. Verify the certificate
2. Upgrade to at least PHP 5.6.0 / OpenSSL 1.0.1
3. Save and reference cacert.pem

1. Verify the certificate

Use curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); to verify the certificate.

2. Upgrade to at least PHP 5.6.0 / OpenSSL 1.0.1

Upgrade to at least PHP 5.6.0 , which seems to bring along with it OpenSSL/1.0.1i . I think at least OpenSSL version 1.0.1 is required to support TLS 1.2, which PayPal requires.

3. Save and reference cacert.pem

Save cacert.pem from http://curl.haxx.se/docs/caextract.html locally (in my case to c:\\cert ), then update the PHP ini that you're using to reference cacert.pem as shown here . Using the ini file saves you having to use curl_setopt($ch, CURLOPT_CAINFO, dirname(__FILE__) . '\\cacert.pem'); in every call.