Merchant Security Upgrade Testing (PP-LIVE-8238)

[MTS_Ciaran]

Testing to being April 12th 2018. Please see HERE for full schedule.

 

Please Use this thread for any questions related to the Security Upgrades coming June 2018 and the upcoming testing for these changes. 

For full details on these changes click HERE

------------------------------------

AFFECTED PRODUCTS:

• REST APIs
• SOAP & NVP APIs
• Payflow APIs
• Homepage
• Online Checkout
• Retail Checkout
• Account
• Payflow

Initial Notification:

To prepare for the Payment Card Industry (PCI) mandated security upgrade deadline of June 30, 2018, PayPal plans a series of tests to verify that our API endpoints meet the latest security standards.

If you have already upgraded your integration to the highest security protocols, you should not experience impacts from our testing.

However, if you have not upgraded your PayPal integrations to comply with these standards, service interruptions may occur during our testing windows.

It is strongly recommended that you perform the necessary upgrades immediately as we will be performing tests from March 12 to March 22, and early June 2018. Below is a quick summary of the testing schedule for the first round of tests:

• March 12-14: TLS 1.2
• March 14-15: GET response
• March 19-21: HTTP 1.1
• March 21-22: Instant Payment Notification (IPN) HTTPS

More information can be found on our Merchant Security Upgrade Testing Microsite.

[MTS_Carlos]

Hi,

All of the information related to the new TLS upgrade can be found in these two resources:

https://www.paypal-notice.com/en/TLS-1.2-and-HTTP1.1-Upgrade/
and
https://www.paypal-notice.com/en/IPN-Verification-Postback-to-HTTPS/ (should you be using IPN)

In order to determine where your account was identified as having an issue, you can create a request to https://www.paypal-techsupport.com/
Our Merchant Technical Support staff can potentially provide some further guidance for you to work with your developer or CRM to ensure the necessary changes are made.

That being said, if you are currently processing transactions through your website successfully to PayPal, you are passing the new TLS protocol.

[LittleZe]

I'm still receiving notifications that I need to upgrade, including mail from the start of the month that finally arrived saying I need to upgrade but when I checked the pages are either "Oops. Not found" or say "Connection OK" so I don't know how I can upgrade to the newest version so I don't have to lose my account. It says I still need to upgrade my TLS but I have no idea how.

[MTS_Andre]

Hi LittleZe, if you are using the APIs for your PayPal transactions (which will communicate via the TLS protocols) you need to check with your server administrator that the TLS protocols v1.2 are used. Your server administrator knows how to upgrade to TLSv1.2 in case it is not already done.

[soapinbox]

Hello, I am trying to add a link to my business FB page. I came across this information TLS 1.2 I might have already have updated. How can I check?

[dragonart]

We too have been getting continuous emails saying we need to be upgraded and now today a phone call - to which we cannot return the call as your systems say there is an error and disconnects us after being on hold for about 10 minutes.

Our host server has confirmed with us back in April that we are good to go and that our server has all the updated software etc. that you are requiring and even some that are newer updates from what you have asked for. It is becoming increasingly concerning that we get these emails and calls when our service has not had any issues and when our host even declares we are fine.

Would someone please be able to update us as to whether or not we are part of a mass email network and no one is really trying to reach us personally as much as generically reaching out to everyone?

Thank you.

[colatechi]

I don't understand how this works and I'm stressing out about it. I was away and nobody told me I got the letter from Paypal explaining the TLS 1.2 update until now. 

[fred75016]

I have migrated all my API calls using the ipnpb.paypal.com subdomain for several days, and the payments are working well.

At first I think all our calls are TLS1.2 compliant, but my boss is asking me why we are still receiving emails and account restrictions ... have I missed something?

[Jet3]

So this morning it happens, I get this message:

Your account was limited for failing to upgrade your encryption protocols to Transport Layer Security (TLS) 1.2. You will not be able to move money out of your PayPal account until you make the required update.

I upgraded to TLS 1.2 a number of days ago.  I've tested with sandbox multiple times (and it works fully).

It's 100% clear in the documentation that sandbox was already upgraded to 1.2, and that if you hadn't upgraded the sandbox would work.

And there's nothing that will tell me where the problem is.  (if there is one which I don't believe there is).

Any MTS don't reply to questions about it, and I can't get through to a real person at MTS, only staff who have no clue about the upgrade.

[MTS_Carlos]

Hi,

All of the information related to the new TLS upgrade can be found in these two resources:

https://www.paypal-notice.com/en/TLS-1.2-and-HTTP1.1-Upgrade/
and
https://www.paypal-notice.com/en/IPN-Verification-Postback-to-HTTPS/ (should you be using IPN)

In order to determine where your account was identified as having an issue, you can create a request to https://www.paypal-techsupport.com/
Our Merchant Technical Support staff can potentially provide some further guidance for you to work with your developer or CRM to ensure the necessary changes are made.

That being said, if you are currently processing transactions through your website successfully to PayPal, you are passing the new TLS protocol.

[MTS_Carlos]

Hi,

All of the information related to the new TLS upgrade can be found in these two resources:

https://www.paypal-notice.com/en/TLS-1.2-and-HTTP1.1-Upgrade/
and
https://www.paypal-notice.com/en/IPN-Verification-Postback-to-HTTPS/ (should you be using IPN)

In order to determine where your account was identified as having an issue, you can create a request to https://www.paypal-techsupport.com/
Our Merchant Technical Support staff can potentially provide some further guidance for you to work with your developer or CRM to ensure the necessary changes are made.

That being said, if you are currently processing transactions through your website successfully to PayPal, you are passing the new TLS protocol.