I run a website on a server running Centos 5.11 - EOL now I know but an upgrade is not possible for a while. The website runs the Sellerdeck software which integrates with Paypal for payments.
In the next month or so Paypal will require me to be using TLS 1.2  for connections to them, which is not supported by the default OpenSSL version installed in 5.11 (0.9.8b).
I have followed instructions  to install a second version of OpenSSL, and a second version of Curl linked to that new version of OpenSSL, which will support TLS 1.2, but it still doesn't pass the Paypal Test.
Centos 5.11 with OpenSSL 1.0.2k in /usr/local/:
/usr/local/bin/curl https://tlstest.paypal.com curl: (35) Unknown SSL protocol error in connection to tlstest.paypal.com:443
Centos 6.9 with OpenSSL 1.0.1e-fips
curl https://tlstest.paypal.com PayPal_Connection_OK
Can anyone help point me in the right direrction as to why the connection is not working with the updated OpenSSL?
Thanks very much
Verbose non-working output:
/usr/local/bin/curl -Ivvv https://tlstest.paypal.com * Rebuilt URL to: https://tlstest.paypal.com/ * Trying 184.108.40.206... * Connected to tlstest.paypal.com (220.127.116.11) port 443 (#0) * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * successfully set certificate verify locations: * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * TLSv1.0, TLS handshake, Client hello (1): * Unknown SSL protocol error in connection to tlstest.paypal.com:443 * Closing connection 0 curl: (35) Unknown SSL protocol error in connection to tlstest.paypal.com:443
Verbose working output:
curl -Ivvv https://tlstest.paypal.com * About to connect() to tlstest.paypal.com port 443 (#0) * Trying 18.104.22.168... connected * Connected to tlstest.paypal.com (22.214.171.124) port 443 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 * Server certificate: * subject: CN=tlstest.paypal.com,OU=CDN Support,O="PayPal, Inc.",STREET=2211 N 1st St,L=San Jose,ST=California,postalCode=95131-2021,C=US,serialNumber=3014267,businessCategory=Private Organization,incorporationState=Delaware,incorporationCountry=US * start date: Nov 06 00:00:00 2015 GMT * expire date: Oct 26 23:59:59 2017 GMT * common name: tlstest.paypal.com * issuer: CN=Symantec Class 3 EV SSL CA - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US > HEAD / HTTP/1.1 > User-Agent: curl/7.19.7 (i386-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2 > Host: tlstest.paypal.com > Accept: */* > < HTTP/1.1 200 OK HTTP/1.1 200 OK < Content-Type: text/html Content-Type: text/html < Content-Length: 20 Content-Length: 20 < Date: Sat, 06 May 2017 12:58:47 GMT Date: Sat, 06 May 2017 12:58:47 GMT < Connection: keep-alive Connection: keep-alive < * Connection #0 to host tlstest.paypal.com left intact * Closing connection #0