john mccoy

Thanks fro your reply. An SSL cert is in place, and it looks like the cert is OK, unfortunately I think IPN needs sorting out because the site admin got an email from PayPal saying that IPN via HTTPS was an issue that needs to be corrected by 30/9/16 Extract from email from PayPal >> Step 2: Understand how these changes affect your integration. Here are the key areas requiring your attention. If the chart shows “Yes”, you may require changes to be compatible with that security upgrade. If you see a “No,” our data shows that you are already compliant or do not use that functionality. There may be other changes you need to make, but please pay particular attention to the following areas: Change Do I need to make a change? SSL Certificate Upgrade to SHA-256 No TLS 1.2 and HTTP/1.1 Upgrade No IPN Verification Postback to HTTPS Yes IP Address Update for PayPal Secure FTP Servers No Merchant API Certificate Credential Upgrade No Discontinue Use of GET Method for Classic NVP/SOAP APIs No >>

My customers site uses a customised version of CC4 but with the standard Paypal Gateway Paypal now required the IPN verification to be updated to use HTTPS rather than HTTP as at present In CC4 I can see that you could use admin to set the whole site to use SSL/ HTTPS, but I'm sure that would really slow the whole site down. I can't see a way in CC4 to use the admin system to just set IPN verification to use HTTPS. Have I missed something? I've looked at the code and it looks like the verification is in file modules\gateway\PayPal\call.inc.php Has anyone managed to modify this gateway / file to work with the new 'HTTPS-only' PayPal sandbox IPN url ipnpb.sandbox.paypal.com ? more info here: https://www.paypal-knowledge.com/infocenter/index?page=content&widgetview=true&id=FAQ1916&viewlocale=en_US TIA John