A client site I built a while back has been ignoring emails from paypal for the last couple of years until yesterday when they closed down his account due to his site not utilsing TLS 1.2.

The site is hosted on a Digital Ocean VPS running Centos 7 with a let's encypt ssl cert.

I've done an ssl test at https://www.ssllabs.com/ which informs me that that tls 1.2 is enabled, however, a small script (below) I wrote to curl paypal's https://tlstest.paypal.com confirms that it is not configured correctly (ERROR! Connection is using TLS version lesser than 1.2. Please use TLS1.2).

enter image description here

$ch = curl_init();
$timeout = 5;
$url = "https://tlstest.paypal.com/";
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
$data = curl_exec($ch);

Outputting the SSL version gives me NSS/3.15.4

A lowly front end dev, I'm a bit of a loss how to proceed. A bit of research had someone suggest that I add SSLProtocol -all +TLSv1.2 to the site's vhost, but after an apache restart, this made no difference and I still get the paypal error message on my curl. (It's original lets encrypt setting was SSLProtocol all -SSLv2 -SSLv3)

Here's my vhosts: enter image description here

Could someone point me in the right direction or explain to me (in simple terms how to remedy my problem?)


The email from paypal:

The Payment Card Industry Security Standards Council (PCI) has issued new security standards that must be implemented by June 30, 2018. By this date, all entities must have stopped the use of SSL/early TLS as a security control in their systems and completely transitioned to a secure version of TLS encryption protocols, such as TLS 1.2. Our records indicate that your PayPal integration is utilizing a version that is less than TLS 1.2. You must act immediately to upgrade your PayPal integration(s) to utilize TLS 1.2 cryptographic protocol PRIOR to June 30, 2018. Failure to upgrade your integration prior to June 30, 2018 means you will be at risk TO ACCEPT ANY PAYPAL TRANSACTIONS OR CREDIT CARD PAYMENTS PROCESSED BY PAYPAL without upgrading your payment software to support TLS 1.2.

  • 1
    The curl thing looks like a part of a completely different question. Does PayPal say you lack TLSv1.2 as client-side (curl) or on server-side (apache httpd)? Do you know these are independent and that they can use different TLS libraries? – kubanczyk Jul 3 '18 at 18:18
  • @kubanczyk I did not know they were different. Thank you for letting me know :) They aren't too clear on the requirement TBH. The work is for a client for his client so I'm getting the information third hand. I've been forwarded an email. I'll paste it above. – Fraser Jul 3 '18 at 18:22
  • You need to take care of a client-side first (i.e. curl). Expand these parts, include curl -v .... I suggest to remove from the question all that pertains to server-side (apache httpd and ssllabs.com) and post it later - if required. – kubanczyk Jul 3 '18 at 18:28
  • Ugh. I get it now, it's PHP curl_init stuff and not standalone curl program. It's definitely unanswerable at this level of detail. – kubanczyk Jul 3 '18 at 18:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.