XAMPP on Windows srv 2012 R2 IPN issue

Question

I have latest xampp on win server 2012 R2, and have successfully installed ssl certificate for my domain, and it is accessible from outside ( my site: https://www.n-aos.com/ ). Site is serving ok!

I'm using official paypal php ipn code from here: https://github.com/paypal/ipn-code-samples/blob/master/paypal_ipn.php#L58-L59 and the issue that is not working is marked, line 58 and 59.

If I set the CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST to 0 then the service works ok, but I would not like to work without verification...

Also I did tried to download the cabundle certs from ( http://curl.haxx.se/docs/caextract.html ) and have uncommented lines to use that certs, but error is the same as without lines 79 and 80

The debug error log only have this line:

[2015-01-23 10:36 Europe/Zagreb] Can't connect to PayPal to validate IPN message: SSL certificate problem: unable to get local issuer certificate

If there is something that you could think of that I could do I would be very appreciative. Btw, this same peace of code for ipn check did worked couple a months back when it was hosted from linux box (some debian distro), if that helps any.

thx, kreso

Answer 1

Ok, after very long and thorough testing and trying to get paypal IPN to work, colleague of mine, found out what the illness was, so I'll post it here for someone else in my shoes to sleep well :)

Our server ipn address is https and this steps was needed.

Inside php file that is talking with paypal add this lines:

curl_setopt($ch, CURLOPT_SSLCERT, 'c:/path/some.crt');
curl_setopt($ch, CURLOPT_SSLKEY, 'c:/path/some.key');
curl_setopt($ch, CURLOPT_CAINFO, 'c:/path/cabundle.crt');

for first and second line add full path to the cert file of your domain that is curl-ing to paypal.

For the third line, this is tricky part, add second older certificate, from this page

http://curl.haxx.se/docs/caextract.html

the one that has verisign key of 1024bit long! :)

The strange part was that tests on some ssl sites did passed with new cabundle, like google, bank site but paypal failed.. so that did puzzled us

The direct link to the cert file on github is located here: github link from 13.08.2015

cheers,