SSL Error while verifying Paypal IPN

Same problem here. Did you ever find a solution?

George

This was a while ago. If I remember Correctly, the hosting provider did not have the standard certificate authorities installed and therefor curl cannot verify that certificate is correct.

The solution is either to download the certificate for the root CA that signed te certificate in question, or link to a bundle of CA certificates. I did the bundle. you link to it within your php code. As for linking to the bundle, you need to do it somewhere within the WordPress source, in the bit that does remote connections.

I can’t remember where I found it, but you might find it in a google search. If I get a chance this week I’ll post something on my blog and put a link here.

Hope that helps,
Mike

Thanks for the v. fast reply. It’s no wonder I get the failure – I’m working on a development system (my laptop) that has no notion of CA certificates. So I guess I next need to figure out how to get some.

Thanks again.

George

Hope you find the time for some archaeology.

I’ve progressed from “SSL3_GET_SERVER_CERTIFICATE:certificate verify failed” to “SSL timeout”. And then hit a wall.

g

To clarify, are you using the PayPal Framework plugin?

Yes; v 1.0.8. In a terse exchange of e-mails with the author it was suggested I’ve got an out-of-date CA certificate. Thought I’d added the current sandbox cert to a bundle from the cUrl site.

I need to learn more about the workings of SSL & the listener code to understand where the timeout comes from. Gotta love those steep learning curves.

g

Hi George,

So this is what I think I did:

I created a folder within the paypal-framework plugin directory called ‘CACERTS’. To this folder I added a couple certificates including (majorly) this one:https://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1

This certificate is the stock CA’s included in Firefox (straight from mozilla to boot!)

I then added the following lines to the paypal-framework.php file at the very start of the ‘_validateMessage()’ function: (ensure to replace ‘<—————Name of Certificate file——————>’ with the filename of the certificates you want.

$ch = curl_init();
                curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
                curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
                $_POST['cares'] = curl_setopt($ch, CURLOPT_CAINFO, dirname(__FILE__) . "/CAcerts/<---------------Name of Certificate file------------------>");
                $_POST['caurl'] = dirname(__FILE__) . "/CAcerts/<---------------Name of Certificate file------------------>";
		// Set the command that is used to validate the message
		$_POST['cmd'] = "_notify-validate";

Like I said, I really don’t remember a whole lot about this, except for having to do ALOT to get this working.. I checked my old copy of WP and I don’t think I had to modify the source to get this to work. Let me know if it works for you though… Also note that I did this using V1.06 of paypal-framework and 3.1 of WordPress, so something may have changed with the versions.

Hope this helps.
Mike

Mike,

Thanks immensely for taking the time to dig into this. I’ll certainly try this out and let you know what happens.

I’m still getting the timeout and have sunk to looking at packet traces to see if I can learn anything. I’ve got a post up at a PayPal forum, one here at WPville, and an e-mail in to the plugin author. Somewhere there’s gotta be an answer.

Fingers crossed.

George

Mike,

Looks like the world has spun around a few times since v1.06. All of the cUrl functionality is now in class-http.php. The _validateMessage() function calls wp_remote_post with a url and a parameter array. While I’ve been known to hack a few lines of code, this is terra incognito for me. So while I’m glad your hack works for you, I’m outta my depth trying to apply it here.

I’ve totally given up on making this IPN work. I’m recommending to my client that they look at options other than plugins to accomplish their goals.

I very much appreciate your efforts on my behalf. Best regards.

George