Page 5 of 7 FirstFirst ... 34567 LastLast
Results 41 to 50 of 64
  1. #41
    Join Date
    Jan 2004
    Posts
    65,182
    Blog Entries
    7
    Plugin Contributions
    223

    Default Re: PayPal Error (35) error:1408F10B SSL3_GET_RECORD:wrong version number

    Quote Originally Posted by mprough View Post
    PP tech support told me it's only a 24 hr reprieve
    That wouldn't surprise me.
    .

    Zen Cart - putting the dream of business ownership within reach of anyone!
    Donate to: DrByte directly or to the Zen Cart team as a whole

    Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
    Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

  2. #42
    Join Date
    Feb 2007
    Location
    Pennsylvania
    Posts
    695
    Plugin Contributions
    0

    Default Re: PayPal Error (35) error:1408F10B SSL3_GET_RECORD:wrong version number

    thank you

  3. #43
    Join Date
    Jun 2003
    Location
    Newcastle UK
    Posts
    2,877
    Blog Entries
    2
    Plugin Contributions
    2

    Default Re: PayPal Error (35) error:1408F10B SSL3_GET_RECORD:wrong version number

    I've done some quick and dirty testing using wireshark to analyze the ssl handshake.

    the results seem to suggest that these 3 scenarios are all similar
    eg
    Using
    curl_setopt($ch, CURLOPT_SSLVERSION, 1);
    curl_setopt($ch, CURLOPT_SSLVERSION, 4);
    or in fact removing the curl_setopt($ch, CURLOPT_SSLVERSION, n); line completely
    will force version negotiation and curl will then use TLS

    It should be noted that php documentation is pretty poor on this. Suggesting that only 2 and 3 are valid options for CURLOPT_SSLVERSION but that given no version php will negotiate for the most recent version e.g. tls v1.2

    As has been noted, paypal seems to have re added ssl v3 to their main live endpoint, while their sandbox is blocking ssl v3.
    This maybe because they gave no notice, and have had mega complaints. It's still likely they will turn off ssl v3 on the live endpoints soon.

    At this point, the advice DrByte posted in the release announcements should still be followed:
    http://www.zen-cart.com/showthread.p...yment-security

    We will of course update that based on any further information.

  4. #44
    Join Date
    Jan 2004
    Posts
    65,182
    Blog Entries
    7
    Plugin Contributions
    223

    Default Re: PayPal Error (35) error:1408F10B SSL3_GET_RECORD:wrong version number

    To add a point of clarity, for those technically-minded, here are currently-valid SSL/TLS versions, listed from most-secure to least-secure:

    Best to worst:
    TLS 1.2 (best choice today)
    TLS 1.1
    TLS 1.0
    SSL 3.0 (has the POODLE vulnerability)
    SSL 2.0 (generally not recommended, and typically not even available in modern webservers)
    SSL 1 (obsolete, no longer offered)

    So, what wilt and I have been investigating is the net impact against performance based on the code changes I've been posting about.

    And, so reading between the lines from wilt's post above, what we're seeing is that if one sets CURLOPT_SSLVERSION to 2 or 3, it will try SSL 2.0 or SSL 3.0, respectively, but if one comments-out the CURLOPT_SSLVERSION then the best TLS (or SSL if no TLS versions can be negotiated) will be selected.

    (Admittedly we've also confirmed that setting CURLOPT_SSLVERSION to 1 does cause it to jump to autonegotiating a TLS version, but we'd like to do more research before recommending a specific value, since specifying a value like 5 or higher actually causes errors.)

    Hope that helps answer questions for those who are curious.
    .

    Zen Cart - putting the dream of business ownership within reach of anyone!
    Donate to: DrByte directly or to the Zen Cart team as a whole

    Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
    Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

  5. #45
    Join Date
    Jan 2004
    Posts
    65,182
    Blog Entries
    7
    Plugin Contributions
    223

    Default Re: PayPal Error (35) error:1408F10B SSL3_GET_RECORD:wrong version number

    Further, PayPal has posted today that they will (shortly) fully remove SSLv3 support from their servers ... so commenting-out the CURLOPT_SSLVERSION will be necessary ASAP.

    Ref: https://www.paypal-community.com/t5/...LE/ba-p/891829
    .

    Zen Cart - putting the dream of business ownership within reach of anyone!
    Donate to: DrByte directly or to the Zen Cart team as a whole

    Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
    Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

  6. #46
    Join Date
    Jun 2003
    Location
    Newcastle UK
    Posts
    2,877
    Blog Entries
    2
    Plugin Contributions
    2

    Default Re: PayPal Error (35) error:1408F10B SSL3_GET_RECORD:wrong version number

    We have also turned off SSl v3 support to the forum. This really shouldn't affect your experience in the forum, as content is negotiated via your browser.
    Last edited by wilt; 15 Oct 2014 at 11:47 PM.

  7. #47
    Join Date
    Nov 2008
    Posts
    191
    Plugin Contributions
    0

    Default Re: PayPal Error (35) error:1408F10B SSL3_GET_RECORD:wrong version number

    I also use paypal payments standard. I just tested my site, and made a purchase with paypal and made a purchase with authorize.net credit card, and everything is working fine. Do you know why I would not be affected? Is it because I am using website payments standard?

    What fix should people with paypal payments standard do? And we should do it even though there is no error??

  8. #48
    Join Date
    Jan 2004
    Posts
    65,182
    Blog Entries
    7
    Plugin Contributions
    223

    Default Re: PayPal Error (35) error:1408F10B SSL3_GET_RECORD:wrong version number

    Quote Originally Posted by WiccanWitch420 View Post
    I also use paypal payments standard. I just tested my site, and made a purchase with paypal and made a purchase with authorize.net credit card, and everything is working fine. Do you know why I would not be affected? Is it because I am using website payments standard?

    What fix should people with paypal payments standard do? And we should do it even though there is no error??
    Yes, make the change anyway. PayPal will be re-imposing the change they backed-out earlier today.
    .

    Zen Cart - putting the dream of business ownership within reach of anyone!
    Donate to: DrByte directly or to the Zen Cart team as a whole

    Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
    Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

  9. #49
    Join Date
    Nov 2008
    Posts
    191
    Plugin Contributions
    0

    Default Re: PayPal Error (35) error:1408F10B SSL3_GET_RECORD:wrong version number

    Quote Originally Posted by DrByte View Post
    Yes, make the change anyway. PayPal will be re-imposing the change they backed-out earlier today.
    But earlier today when everyone's site was not working with it, mine was. So i just want to clarify that since I only use website payments standard, that i need to do it, because i dont think it affects me. And if i need to do something , what do i need to do for the web standard?

  10. #50
    Join Date
    Jan 2004
    Posts
    65,182
    Blog Entries
    7
    Plugin Contributions
    223

    Default Re: PayPal Error (35) error:1408F10B SSL3_GET_RECORD:wrong version number

    While Zen Cart's implementation of PayPal Standard is not directly affected by this, I strongly believe you SHOULD STILL APPLY THE CHANGE, as it helps keep your site future-proofed and therefore more secure.
    .

    Zen Cart - putting the dream of business ownership within reach of anyone!
    Donate to: DrByte directly or to the Zen Cart team as a whole

    Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
    Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

 

 
Page 5 of 7 FirstFirst ... 34567 LastLast

Similar Threads

  1. Replies: 1
    Last Post: 9 Dec 2011, 01:15 AM
  2. Paypal IPN error - wrong e-mail address
    By Moncia in forum PayPal Express Checkout support
    Replies: 24
    Last Post: 4 Oct 2007, 12:37 PM
  3. outdated version of PayPal error
    By oavs in forum General Questions
    Replies: 4
    Last Post: 19 Apr 2007, 12:28 AM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
disjunctive-egg
Zen-Cart, Internet Selling Services, Klamath Falls, OR