PayPal Error (35) error:1408F10B SSL3_GET_RECORD:wrong version number

PayPal Express has been working well up until we received this error.

Dear store owner,
An error occurred when attempting to initiate a PayPal Express Checkout transaction. As a courtesy, only the error "number" was shown to your customer. The details of the error are shown below.

(35) error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

Zen Cart message: An error occurred when we tried to contact the payment processor. Please try again, select an alternate payment method, or contact the store owner for assistance.

Problem occurred while customer was attempting checkout with PayPal
Express Checkout.

We are ZC v1.5.1

Thanks for any insight you can provide.

Phil and Pam
https://www.heirloomstocherish.com

Two carts just started throwing errors with PayPal Pro.

First error is error:14094410:SSL routines:SSL3_READ_BYTES:sslv3

Second is error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong
version number

I found a post here: http://stackoverflow.com/questions/26378351/error1408f10bssl-routinesssl3-get-recordwrong-version-number-paypal-maybe

It says they believe PayPal has changed - and the fix someone has discover is this:
curl_setopt($handle, CURLOPT_SSLVERSION, 4);

Has anyone heard anything?

Just found this: https://www.ssllabs.com/ssltest/analyze.html?d=https%3A%2F%2Fapi-3t.sandbox.paypal.com%2Fnvp

Getting this too. Same ZC version 1.5.1

Looks like a sudden change made by Paypal, some discussion here: http://stackoverflow.com/questions/26378351/error1408f10bssl-routinesssl3-get-recordwrong-version-number-paypal-maybe

Phil Soth:

PayPal Express has been working well up until we received this error.

Dear store owner,
An error occurred when attempting to initiate a PayPal Express Checkout transaction. As a courtesy, only the error "number" was shown to your customer. The details of the error are shown below.

(35) error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

Zen Cart message: An error occurred when we tried to contact the payment processor. Please try again, select an alternate payment method, or contact the store owner for assistance.

Problem occurred while customer was attempting checkout with PayPal
Express Checkout.

We are ZC v1.5.1

Thanks for any insight you can provide.

Phil and Pam
www.heirloomstocherish.com

Sounds like this (posted about 8hrs ago)
http://stackoverflow.com/questions/26378351/error1408f10bssl-routinesssl3-get-recordwrong-version-number-paypal-maybe

I'm not sure this will be of any help though. Point is, you're not alone.

Cheers
RodG

PS: Shoot. you just beat me to it. Exact same link. LOL

Yes, the immediate solution is to change the CURLOPT_SSLVERSION from 3 to 4 ... or comment-out the line entirely.

RodG:

Shoot. you just beat me to it. Exact same link. LOL

Cheers
RodG

Hehe, as you say--good to know we're all aware of it. Hopefully the thread catches the attention of the right people, assuming any ZC updates are needed.
The stackoverflow thread links to the Paypal SDK github discussion, which has been updated to closed/resolved.

Add me to the list as well. Both pro and express checkouts affected. Orders bouncing all morning.

DrByte:

Yes, the immediate solution is to change the CURLOPT_SSLVERSION from 3 to 4 ... or comment-out the line entirely.

In the Paypal github discussion (https://github.com/paypal/rest-api-sdk-php/pull/127) the "official" recommendation appears to be changing CURLOPT_SSLVERSION

I have no expertise here, just reading the posts; happy to follow the official ZC recommendation.
Changes to: "/includes/modules/payment/paypal/paypal_curl.php" correct?

I found the string to change, fortunately its easy:

/web/content/includes/modules/payment/paypal/paypal_curl.php
Line #58 : CURLOPT_SSLVERSION => 3,

Change to CURLOPT_SSLVERSION => 4,

It works ...for now. Thanks for the notice paypal...

nightdesigns:

I found the string to change, fortunately its easy:

/web/content/includes/modules/payment/paypal/paypal_curl.php
Line #58 : CURLOPT_SSLVERSION => 3,

Change to CURLOPT_SSLVERSION => 4,

It works ...for now. Thanks paypal

Good to hear it worked for you. It was a sudden change, but it's related to a new, serious bug with ssl: "Poodle"

I know it was an urgent fix, but some announcement would have been nice. They're usually pretty good about letting us know about other changes.

So glad I saw this thread today! I was pulling my hair trying to figure out why the error was being thrown. Made the edit to CURLOPT_SSLVERSION from 3 to 4 and that seems to have done the trick! Yea! Thanks PayPal for letting us know!

http://www.zen-cart.com/showthread.php?214916-Important-announcement-about-POODLE-and-payment-security&p=1261356#post1261356

DrByte:

http://www.zen-cart.com/showthread.php?214916-Important-announcement-about-POODLE-and-payment-security&p=1261356#post1261356

Thanks for dealing with this so quickly!

Please see official recommendation from Zen Cart Team: http://www.zen-cart.com/showthread.php?214916-Important-announcement-about-POODLE-and-payment-security

All the carts I have been checking on are getting this error too. I tried the fix on one cart and 5 minutes later an order came through so the fix worked. Will this be the permanent fix or should we expect to need to update the paypal express module in the near future?

buildingblocks:

Will this be the permanent fix or should we expect to need to update the paypal express module in the near future?
For now this is a known and verified fix, and worth rolling out to all your sites immediately.
However, it's early days on this we are indeed researching whether there are even better fixes available. But that's NO reason to not apply the known fix NOW.

Time will tell whether there is an even better fix. We will post in the Release Announcements if there is an updated better solution.

Is it only with IE? I was under the impression that Chrome and Firefox work and do not have the vulnerability.

OLD MAN:

Is it only with IE? I was under the impression that Chrome and Firefox work and do not have the vulnerability.
Today's PayPal issue has nothing whatsoever to do with what browser is being used.

I take it this doesn't affect paypal website payments standard? I haven't had any issues today... ?