PayPal IPN stopped working with Tomcat/Open SSL after POODLE update

Question

The PayPal IPN messages stopped coming through after PayPal made a change to cater for the POODLE vulnerability ( link ).

We are running Java 1.6 and Tomcat 6.

Answer 1

PayPal investigated the problem, and here is the response:

The issue could be related to the web server your using (Tomcat) and the implementation of ciphers in Open SSL 1.0.

When testing your IPN URL using CURL, we are receiving the following error "error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error"

This appears to be an issue with Open SSL 1.0 and Tomcat, as outlined in the following article - http://georgik.sinusgear.com/2012/02/19/tomcat-7-and-curl-ssl23_get_server_hellotlsv1-alert-internal-error/

So we modified our tomcat server.xml to have the following:

ciphers="SSL_RSA_WITH_RC4_128_SHA"

And the PayPal IPNs started working again.