TLS 1.2 and HTTP/1.1 upgrade (PHP fsockopen)

[Test05122017]

Hello,

I am new to PHP & PayPal and trying to figure it out whether I need to upgrade TLS or not according to the following PayPal article: https://www.paypal-knowledge.com/infocenter/index?page=content&id=FAQ1914

I tried testing the system using "tlstest.paypal.com" and "sandbox.paypal.com" endpoints.

When I tested using "tlstest.paypal.com" endpoint, I've got the message below right away, followed by "PayPal_Connection_OK" after 6-8 minutes.

HTTP/1.1  200 OKContent-Type: text/htmlContent-Length: 20
Connection: keep-alive

When I tested using "sandbox.paypal.com" endpoint, the result was "verified" and the payment status was "completed".

However I noticed 30 seconds delay.

In order to get my code to work I had to make 2 modifications:

1) add "Connetion: Close" in the header (otherwise the connection was "hanging" and generated an error message "fgets ssl: connection reset by peer")

    $header .= "Connection: Close\r\n"; 

2) trim the result

     if (strcmp (trim($result), "VERIFIED") == 0) {          // VALID PAYMENT!

Am I good to go?  Any idea what is causing the delays?

Thank you.

[MTS_Ciaran]

I suspect that the delay was happening because of connection being kept open, Im surprised by the 6-8 minute delay on the test though. When you coded to close the connection how long did it take?

Also in general the above sounds like your good to go from a TLS and HTTP1.1 point of view.

[Test05122017]

Hello,

Thank you for getting back to me.

The 6-8 minutes delay were when I tested tlstest.paypal.com endpoint using my production paypal account to make the payment.

I just re-tested the sandbox (sandbox.paypal.com) and production (paypal.com) earlier this morning.

Production configuration:

$header = '';
$header .= "POST /cgi-bin/webscr HTTP/1.1\r\n";
$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
$header .= "Connection: Close\r\n";
$header .= "Host: www.paypal.com\r\n";
$header .= "Content-Length: " . strlen($req) . "\r\n\r\n";
$paypaladdr = 'www.paypal.com';

$fp = fsockopen('ssl://'.$paypaladdr, 443, $errno, $errstr, 30);

if (strcmp (trim($result), "VERIFIED") == 0) { // VALID PAYMENT!

Sandbox configuration:

$header = '';
$header .= "POST /cgi-bin/webscr HTTP/1.1\r\n";
$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
//$header .= "Host: www.paypal.com\r\n";
$header .= "Connection: Close\r\n"; //uncomment and see if it makes a difference
$header .= "Host: www.sandbox.paypal.com\r\n";
$header .= "Content-Length: " . strlen($req) . "\r\n\r\n";
$paypaladdr = 'www.sandbox.paypal.com';

$fp = fsockopen('ssl://'.$paypaladdr, 443, $errno, $errstr, 30);

    if (strcmp (trim($result), "VERIFIED") == 0) {          // VALID PAYMENT!

I checked the logs and payment was "verified" and "completed" both times.

However I have a piece of code that is supposed to enrol the user in a course if the payment is successful.

I just noticed the enrolment is delayed for about 30 seconds in both sandbox and production.

Any idea what could it be?

Thank you

[Test05122017]

Hi,

Thank you for getting back to me.

I've got the 6-8 minutes delays when I tested tlstest.paypal.com using my paypal account to make the payment.

I re-tested sandbox (sandbox.paypal.com) and production (paypal.com) this morning after making the code changes to close the connection and trim the result.

Production code:

$header = '';
$header .= "POST /cgi-bin/webscr HTTP/1.1\r\n";
$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
$header .= "Connection: Close\r\n";
$header .= "Host: www.paypal.com\r\n";
$header .= "Content-Length: " . strlen($req) . "\r\n\r\n";
$paypaladdr = 'www.paypal.com';

$fp = fsockopen('ssl://'.$paypaladdr, 443, $errno, $errstr, 30);

  if (strcmp (trim($result), "VERIFIED") == 0) {          // VALID PAYMENT!

Sandbox code:

$header = '';
$header .= "POST /cgi-bin/webscr HTTP/1.1\r\n";
$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
//$header .= "Host: www.paypal.com\r\n";
$header .= "Connection: Close\r\n"; //uncomment and see if it makes a difference
$header .= "Host: www.sandbox.paypal.com\r\n";
$header .= "Content-Length: " . strlen($req) . "\r\n\r\n";
$paypaladdr = 'www.sandbox.paypal.com';

$fp = fsockopen('ssl://'.$paypaladdr, 443, $errno, $errstr, 30);

    if (strcmp (trim($result), "VERIFIED") == 0) {          // VALID PAYMENT!

I checked the logs and the payment is "completed" and "verified" in both situations.

However I have a piece of code that is supposed to enrol the user in a course.

I noticed about 30 seconds delay in both situations.

Any idea what could it be?

Thank you.

[MTS_Ciaran · Accepted solution]

For IPN 30 seconds from Completed transaction to finish of IPn verification would be about right given that the verification phase takes messaging back and forth between your server and ours. 

[Test05122017]

Thank you.  I also tested the existing system without the code changes and I experienced the same delays.

[MTS_Ciaran]

For IPN 30 seconds from Completed transaction to finish of IPn verification would be about right given that the verification phase takes messaging back and forth between your server and ours.