0

Recently PayPal is requiring servers to support SHA-256. Here's an article referring to this issue:

https://www.paypal-knowledge.com/infocenter/index?page=content&id=FAQ1766&expand=true&locale=en_US

At the top of the article, it states,

Update your integration to support certificates using the SHA-256 algorithm. PayPal is upgrading SSL certificates on all Live and Sandbox endpoints from SHA-1 to the stronger and more robust SHA-256 algorithm.

We have a dedicated CentOS server with numerous sites, mostly WordPress. Quite a few use PayPal IPN but do not have dedicated IPs or SSL Certificates. What needs to be changed to the server so these sites will support SHA-256? Our server is situated with Limestone Networks so I've created a ticket and asked repeatedly for assistance to no avail. They keep repeating SSL's need to be updated on the server. Would that be a wildcase SSL certificate in the usage case I described? Any assistance would be greatly appreciated.

3
  • 2
    Update the system. That is all. Sep 29, 2015 at 1:47
  • Michael Hampton, do you mean update CentOS? If I do cat /etc/*elease, it shows CentOS release 6.7 (Final) which is fairly up to date I believe.
    – yitwail
    Sep 29, 2015 at 8:01
  • 1
    In that case the answer is "nothing". Of course, you should have tested already, and then you would not have needed to ask the question. Sep 29, 2015 at 8:09

2 Answers 2

1

You don't have to do anything to your servers qua servers. But if your servers contain client code, e.g. IPN callbacks that do the IPN verification step by calling a Paypal server, they have to be able to cope with an incoming SHA-256 certificate.

1
  • EJP, thanks for responding. But I have followup questions. How can I determine if it copes with incoming SHA-256, and if it doesn't, what needs to be modified?
    – yitwail
    Sep 29, 2015 at 16:49
1

Right I've carefully read PayPal's announcement (it really could have been clearer) and here is what I understand.

When your sites receive an Instant Payment Notification (IPN) message from PayPal, your "integration" (in this case I'm guessing a WordPress plugin) handles the IPN message. This involves making a request back to PayPal's API, for example at https://api.paypal.com to do some validation.

In this case, your WordPress plugin is acting as an SSL client by connecting out to PayPal's SSL-enabled api server.

Now, PayPal are updating their own SSL certificates for eg api.paypal.com to use SHA256 hashes.

That means that your WordPress plugin, or the underlying PHP version, or the underlying SSL library, must support SHA256 hashes when operating in client mode.

Without any further information about your stack, I can't say whether your plugin/PHP/SSL library would be up to date enough to support this.

However, SHA256 has been around for absolutely ages so unless you are running a seriously out of date centos, I would hazard a guess that you'll be just fine.

Suggested next steps:

  • ensure your centos install is still actively supported
  • make sure all your system packages are up to date, in particular openssl
  • make sure your WordPress installs are up to date
  • make sure your IPN handler plugin is up to date
  • use the PayPal sandbox to send fake IPN messages at a few of your sites and check that they work

Cheers, Paul

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.