A client site I built a while back has been ignoring emails from paypal for the last couple of years until yesterday when they closed down his account due to his site not utilsing TLS 1.2.
The site is hosted on a Digital Ocean VPS running Centos 7 with a let's encypt ssl cert.
I've done an ssl test at https://www.ssllabs.com/ which informs me that that tls 1.2 is enabled, however, a small script (below) I wrote to curl paypal's https://tlstest.paypal.com confirms that it is not configured correctly (
ERROR! Connection is using TLS version lesser than 1.2. Please use TLS1.2).
$ch = curl_init(); $timeout = 5; $url = "https://tlstest.paypal.com/"; curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout); $data = curl_exec($ch); curl_close($ch); print_r($data);
Outputting the SSL version gives me
A lowly front end dev, I'm a bit of a loss how to proceed. A bit of research had someone suggest that I add
SSLProtocol -all +TLSv1.2 to the site's vhost, but after an apache restart, this made no difference and I still get the paypal error message on my curl. (It's original lets encrypt setting was
SSLProtocol all -SSLv2 -SSLv3)
Could someone point me in the right direction or explain to me (in simple terms how to remedy my problem?)
The email from paypal:
The Payment Card Industry Security Standards Council (PCI) has issued new security standards that must be implemented by June 30, 2018. By this date, all entities must have stopped the use of SSL/early TLS as a security control in their systems and completely transitioned to a secure version of TLS encryption protocols, such as TLS 1.2. Our records indicate that your PayPal integration is utilizing a version that is less than TLS 1.2. You must act immediately to upgrade your PayPal integration(s) to utilize TLS 1.2 cryptographic protocol PRIOR to June 30, 2018. Failure to upgrade your integration prior to June 30, 2018 means you will be at risk TO ACCEPT ANY PAYPAL TRANSACTIONS OR CREDIT CARD PAYMENTS PROCESSED BY PAYPAL without upgrading your payment software to support TLS 1.2.