Errors with Paypal Express Checkout (60)SSL Cert Problem/(77) error setting cert

[jrobletto]

I accidentally posted this question in the wrong thread (shipping/payment modules), so I apologize in advance for posting again... The problem is in regards to Paypal Express Checkout.

I have been working on this issue for many days and have read numerous previous posts and attempted several fixes, and to no avail... I will explain everything I can and hopefully some one can help...

I set up my ZC v. 1.5.4 at http://www.oopsheetmusic.com/store about 3 weeks ago. It has not been upgraded. I tried to setup the paypal express checkout and entered all the correct API credentials. The first error was - Error 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed.

I researched this problem and came across solutions involving updates to the php.ini file. I followed these updates and added the curl.cainfo = "" command pointing towards files such as cacert.pem, cabundle.crt, api_cert_chain.crt, etc... these attempts either gave me an error (77) or a (60).

For the cacert.pem file, I get a Error 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed as well, although the curltester.php shows Connecting to Zen Cart Support Server (https) ...GOOD: CURL Connection successful. Without the cacert.pem line, this line also gets an error (60).

The cabundle.crt gives me a Error 77: error setting certificate verify locations: CAfile: /users/oopsheetmusic.com/access/cabundle.crt CApath: /etc/ssl/certs (including the Connecting to Zen Cart Support Server line.)

My research convinced me this was a server problem, I have hosting with Tierranet, but I have been bothering them and they have told me it is not a problem on their end... I talked to them about the new paypal updates, but they said they are definitely up to date and my SSL's are good. I ran a test of my site at https://www.ssllabs.com/ssltest/ as recommended in the post "PayPal upgrading SSL Certificates in 2015" and got an 'A'. It shows it is updated to reflect SHA256. I tried various other solutions such a 2014 POODLE update, but either they didn't help or I was already updated.

I tried to talk to Paypal about an updated cert that I could try to point the php.ini to but the only file they provided me with (g5.cer) caused an error (60) just as as if the curl.cainfo line wasn't there.

I have tried putting in different API credentials - nothing works.. same two errors. Any suggestions or assistance? I don't know if this is to do with the new Paypal Certs or what... but my site is ready to go other than this problem.

By the way, the error shows on the site as soon as you click pay with paypal... you never get to paypal. The error shows right there on my site... I don't know what to do next.

[frank18]

Your issue looks similar to this thread:

https://www.zen-cart.com/showthread....-Verify-Failed

What happens if you run the curltester.php on your site?

/extras/curltester.php

Any errors?

[jrobletto]

I saw that thread... but my hosting company says everything is correct on their end and there is nothing they can do, other than giving me advice to change my php.ini file like I mentioned... but that just causes an Error (77), which is what I'm currently experiencing. Right now, I have the php.ini pointed towards a cabundle.crt I uploaded where they told me to... and when I run the curltester.php, I get:

Testing communications to various destinations. This is a simple diagnostic to determine whether your server can connect to common destinations.
For advanced "details" mode, add ?details=on to the URL.

Connecting to Zen Cart Support Server (http) ...
GOOD: CURL Connection successful.

Connecting to Zen Cart Support Server (https) ...
Error 77: error setting certificate verify locations: CAfile: /users/oopsheetmusic.com/access/cabundle.crt CApath: /etc/ssl/certs

Connecting to USPS (port 80)...
GOOD: CURL Connection successful.

Connecting to USPS Test/Staging/Sandbox Server (port 80)...
GOOD: CURL Connection successful.

Connecting to UPS (port 80)...
GOOD: Socket established

Connecting to UPSXML (SSL) (wwwcie.ups.com) ...
Error 77: error setting certificate verify locations: CAfile: /users/oopsheetmusic.com/access/cabundle.crt CApath: /etc/ssl/certs

Connecting to UPSXML (SSL) (www.ups.com) ...
Error 77: error setting certificate verify locations: CAfile: /users/oopsheetmusic.com/access/cabundle.crt CApath: /etc/ssl/certs

Connecting to UPSXML (SSL) (onlinetools.ups.com) ...
Error 77: error setting certificate verify locations: CAfile: /users/oopsheetmusic.com/access/cabundle.crt CApath: /etc/ssl/certs

Connecting to FedEx (port 80)...
GOOD: Socket established

Connecting to PayPal IPN (port 443)...
GOOD: Socket established

Error 77: error setting certificate verify locations: CAfile: /users/oopsheetmusic.com/access/cabundle.crt CApath: /etc/ssl/certs

Connecting to PayPal IPN (port 443) Sandbox ...
GOOD: Socket established

Error 77: error setting certificate verify locations: CAfile: /users/oopsheetmusic.com/access/cabundle.crt CApath: /etc/ssl/certs

Connecting to PayPal Express/Pro Server ...
Error 77: error setting certificate verify locations: CAfile: /users/oopsheetmusic.com/access/cabundle.crt CApath: /etc/ssl/certs

Connecting to PayPal Express/Pro Sandbox ...
Error 77: error setting certificate verify locations: CAfile: /users/oopsheetmusic.com/access/cabundle.crt CApath: /etc/ssl/certs

Connecting to PayPal Payflowpro Server ...
Error 77: error setting certificate verify locations: CAfile: /users/oopsheetmusic.com/access/cabundle.crt CApath: /etc/ssl/certs

Connecting to AuthorizeNet Production Server ...
Error 77: error setting certificate verify locations: CAfile: /users/oopsheetmusic.com/access/cabundle.crt CApath: /etc/ssl/certs

Connecting to AuthorizeNet Developer/Sandbox Server ...
Error 77: error setting certificate verify locations: CAfile: /users/oopsheetmusic.com/access/cabundle.crt CApath: /etc/ssl/certs

Connecting to First Data GGe4 server (SSL)...
Error 77: error setting certificate verify locations: CAfile: /users/oopsheetmusic.com/access/cabundle.crt CApath: /etc/ssl/certs

Connecting to LinkPointAPI server (port 1129)...
Error 77: error setting certificate verify locations: CAfile: /users/oopsheetmusic.com/access/cabundle.crt CApath: /etc/ssl/certs

Testing completed. See results above.

....

When I take that line (curl.cainfo = "/users/oopsheetmusic.com/access/cabundle.crt") out of the php.ini, which is how it was originally, and run the curltester, it shows...

Testing communications to various destinations. This is a simple diagnostic to determine whether your server can connect to common destinations.
For advanced "details" mode, add ?details=on to the URL.

Connecting to Zen Cart Support Server (http) ...
GOOD: CURL Connection successful.

Connecting to Zen Cart Support Server (https) ...
Error 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.
This error has nothing to do with Zen Cart. It is a server configuration issue.

(If you are running this test on a localhost/PC/dev/standlone server then you can either ignore this until you put the site on a live production server, or temporarily override things by manually configuring the CURLOPT_CAINFO value with a legitimate CA bundle. If you don't know what that means, just defer your CURL testing until you are on a live production webserver!)

Testing again with less security...
GOOD: CURL Connection successful. (but without being able to verify certificate chain. Again: this is a server issue, not a Zen Cart issue.)

Connecting to USPS (port 80)...
GOOD: CURL Connection successful.

Connecting to USPS Test/Staging/Sandbox Server (port 80)...
GOOD: CURL Connection successful.

Connecting to UPS (port 80)...
GOOD: Socket established

Connecting to UPSXML (SSL) (wwwcie.ups.com) ...
Error 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.
This error has nothing to do with Zen Cart. It is a server configuration issue.

(If you are running this test on a localhost/PC/dev/standlone server then you can either ignore this until you put the site on a live production server, or temporarily override things by manually configuring the CURLOPT_CAINFO value with a legitimate CA bundle. If you don't know what that means, just defer your CURL testing until you are on a live production webserver!)

Testing again with less security...
GOOD: CURL Connection successful. (but without being able to verify certificate chain. Again: this is a server issue, not a Zen Cart issue.)

Connecting to UPSXML (SSL) (www.ups.com) ...
Error 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.
This error has nothing to do with Zen Cart. It is a server configuration issue.

(If you are running this test on a localhost/PC/dev/standlone server then you can either ignore this until you put the site on a live production server, or temporarily override things by manually configuring the CURLOPT_CAINFO value with a legitimate CA bundle. If you don't know what that means, just defer your CURL testing until you are on a live production webserver!)

Testing again with less security...
GOOD: CURL Connection successful. (but without being able to verify certificate chain. Again: this is a server issue, not a Zen Cart issue.)

Connecting to UPSXML (SSL) (onlinetools.ups.com) ...
Error 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.
This error has nothing to do with Zen Cart. It is a server configuration issue.

(If you are running this test on a localhost/PC/dev/standlone server then you can either ignore this until you put the site on a live production server, or temporarily override things by manually configuring the CURLOPT_CAINFO value with a legitimate CA bundle. If you don't know what that means, just defer your CURL testing until you are on a live production webserver!)

Testing again with less security...
GOOD: CURL Connection successful. (but without being able to verify certificate chain. Again: this is a server issue, not a Zen Cart issue.)

Connecting to FedEx (port 80)...
GOOD: Socket established

Connecting to PayPal IPN (port 443)...
GOOD: Socket established

Error 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.
This error has nothing to do with Zen Cart. It is a server configuration issue.

(If you are running this test on a localhost/PC/dev/standlone server then you can either ignore this until you put the site on a live production server, or temporarily override things by manually configuring the CURLOPT_CAINFO value with a legitimate CA bundle. If you don't know what that means, just defer your CURL testing until you are on a live production webserver!)

Testing again with less security...
GOOD: CURL Connection successful. (but without being able to verify certificate chain. Again: this is a server issue, not a Zen Cart issue.)

Connecting to PayPal IPN (port 443) Sandbox ...
GOOD: Socket established

Error 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.
This error has nothing to do with Zen Cart. It is a server configuration issue.

(If you are running this test on a localhost/PC/dev/standlone server then you can either ignore this until you put the site on a live production server, or temporarily override things by manually configuring the CURLOPT_CAINFO value with a legitimate CA bundle. If you don't know what that means, just defer your CURL testing until you are on a live production webserver!)

Testing again with less security...
GOOD: CURL Connection successful. (but without being able to verify certificate chain. Again: this is a server issue, not a Zen Cart issue.)

Connecting to PayPal Express/Pro Server ...
Error 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.
This error has nothing to do with Zen Cart. It is a server configuration issue.

(If you are running this test on a localhost/PC/dev/standlone server then you can either ignore this until you put the site on a live production server, or temporarily override things by manually configuring the CURLOPT_CAINFO value with a legitimate CA bundle. If you don't know what that means, just defer your CURL testing until you are on a live production webserver!)

Testing again with less security...
GOOD: CURL Connection successful. (but without being able to verify certificate chain. Again: this is a server issue, not a Zen Cart issue.)

Connecting to PayPal Express/Pro Sandbox ...
Error 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.
This error has nothing to do with Zen Cart. It is a server configuration issue.

(If you are running this test on a localhost/PC/dev/standlone server then you can either ignore this until you put the site on a live production server, or temporarily override things by manually configuring the CURLOPT_CAINFO value with a legitimate CA bundle. If you don't know what that means, just defer your CURL testing until you are on a live production webserver!)

Testing again with less security...
GOOD: CURL Connection successful. (but without being able to verify certificate chain. Again: this is a server issue, not a Zen Cart issue.)

Connecting to PayPal Payflowpro Server ...
Error 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.
This error has nothing to do with Zen Cart. It is a server configuration issue.

(If you are running this test on a localhost/PC/dev/standlone server then you can either ignore this until you put the site on a live production server, or temporarily override things by manually configuring the CURLOPT_CAINFO value with a legitimate CA bundle. If you don't know what that means, just defer your CURL testing until you are on a live production webserver!)

Testing again with less security...
GOOD: CURL Connection successful. (but without being able to verify certificate chain. Again: this is a server issue, not a Zen Cart issue.)

Connecting to AuthorizeNet Production Server ...
Error 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.
This error has nothing to do with Zen Cart. It is a server configuration issue.

(If you are running this test on a localhost/PC/dev/standlone server then you can either ignore this until you put the site on a live production server, or temporarily override things by manually configuring the CURLOPT_CAINFO value with a legitimate CA bundle. If you don't know what that means, just defer your CURL testing until you are on a live production webserver!)

Testing again with less security...
GOOD: CURL Connection successful. (but without being able to verify certificate chain. Again: this is a server issue, not a Zen Cart issue.)

Connecting to AuthorizeNet Developer/Sandbox Server ...
Error 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.
This error has nothing to do with Zen Cart. It is a server configuration issue.

(If you are running this test on a localhost/PC/dev/standlone server then you can either ignore this until you put the site on a live production server, or temporarily override things by manually configuring the CURLOPT_CAINFO value with a legitimate CA bundle. If you don't know what that means, just defer your CURL testing until you are on a live production webserver!)

Testing again with less security...
GOOD: CURL Connection successful. (but without being able to verify certificate chain. Again: this is a server issue, not a Zen Cart issue.)

Connecting to First Data GGe4 server (SSL)...
Error 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.
This error has nothing to do with Zen Cart. It is a server configuration issue.

(If you are running this test on a localhost/PC/dev/standlone server then you can either ignore this until you put the site on a live production server, or temporarily override things by manually configuring the CURLOPT_CAINFO value with a legitimate CA bundle. If you don't know what that means, just defer your CURL testing until you are on a live production webserver!)

Testing again with less security...
GOOD: CURL Connection successful. (but without being able to verify certificate chain. Again: this is a server issue, not a Zen Cart issue.)

Connecting to LinkPointAPI server (port 1129)...
Error 60: SSL certificate problem, verify that the CA cert is OK. Details: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
IMPORTANT NOTE: Error 60 or 61 means that this server has an SSL certificate configuration problem. YOU NEED TO ASK YOUR HOSTING COMPANY SERVER ADMIN FOR ASSISTANCE with fixing the server's OpenSSL certificate chain.
This error has nothing to do with Zen Cart. It is a server configuration issue.

(If you are running this test on a localhost/PC/dev/standlone server then you can either ignore this until you put the site on a live production server, or temporarily override things by manually configuring the CURLOPT_CAINFO value with a legitimate CA bundle. If you don't know what that means, just defer your CURL testing until you are on a live production webserver!)

Testing again with less security...
GOOD: CURL Connection successful. (but without being able to verify certificate chain. Again: this is a server issue, not a Zen Cart issue.)

Testing completed. See results above.

......

Do I need a different/updated cert file? Or is there another way to fix this problem? I have been bothering my hosting company for over a week calling and starting chats.. and they have said it's a problem with the intermediate certificate; and to go to paypal... paypal hasn't been able to help either though.

[frank18]

It is obviously the CA Bundle (intermediate cert) that gives you grief.

If your host is not willing to help further you may want to contact the issuer of your SSL cert and ask them for the correct CA Bundle / intermediate cert.

[frank18]

Also try this checker (leave port at 443) https://www.sslchecker.com/sslchecker

It tells me

ROOT 1 missing

[jrobletto]

Thank you for that; I'm still working on the problem... the certs that the SSL company gave me haven't helped... but I see that Root 1 missing error and am talking to the SSL Support about it now... still getting the error (77)...

[DrByte]

Error 77 suggests to me that the CA files/paths you've specified aren't valid, or that CURL can't read them (permissions?).

This thread: https://www.zen-cart.com/showthread....ights-)-Solved talks about a similar issue, which was resolved by changing to a different PHP version ... and while it's not stated in the thread the reason that switching PHP versions solved it was because of the different php.ini used in the other PHP version.

[jrobletto]

Thanks - It seems a little more complicated than I thought to upgrade the PHP to 5.4. I did do a check of my current version and it is 5.3, so maybe upgrading to 5.4 would fix the problem... doing that seems to be not so easy; I need to use Putty or Terminal from most directions, which I've never done before... is there a site with some simple steps that any one knows of?

[DrByte]

Thanks - It seems a little more complicated than I thought to upgrade the PHP to 5.4. I did do a check of my current version and it is 5.3, so maybe upgrading to 5.4 would fix the problem... doing that seems to be not so easy; I need to use Putty or Terminal from most directions, which I've never done before... is there a site with some simple steps that any one knows of?

Upgrading the PHP version is a server-admin issue, not a Zen Cart issue. Your hosting company should take care of that. Some hosting companies offer choice of PHP versions ... for example, if the hosting company offers cPanel to administrate your hosting account, they often give you a PHP Selector from which you can simply choose the PHP version you want to use on your site (or even per-directory on your site). Most hosting companies document how to use this option, in their help docs.

[jrobletto]

I talked with my hosting company and was told that they are unable to upgrade my PHP version until the second quarter of this coming year once the new Ubuntu version is released, whatever that is.... so from talking to the SSL companies, the hosting company, paypal, and zen cart here, I believe I have good certs, SSLs are good, zen cart is set up correctly.. I put in the correct IPN credentials... and the site works fine other than paypal express...so not sure what to do next... wait for the second quarter of next year? That's sad hah... do I just use Paypal Standard? I really don't want to, but I'm running out of options.