PayPal Error (35) error:1408F10B SSL3_GET_RECORD:wrong version number

I would just like to voice a sincere Thank You to the folks who help make this a true Community. Your willingness to help, and the quickness and professionalism you show is profound. Outstanding job! You all may not be told often enough, but you are truly appreciated.

philip937:

I take it this doesn't affect paypal website payments standard? I haven't had any issues today... ?
If you update paypal_curl.php as advised, you shouldn't have any issues with Standard. I WOULD recommend applying the fix even if you haven't seen any problems yet.

I've made the suggested change. I'll switch back if I notice any issues using the setting on standard.

Ps - the only reason I knew about the issue was because I received an email from Numinix. They are suggesting changing value from 3 to 1..

I think I'll take my advice from here.

Yeah, I sent them a link to the forum. I think the change happened at about 12:30 pm EST. I'm still writing the newsletter (between uploading fixes) for my email list!

I called PayPal this morning, as soon as I received 7 PayPal Express Checkout errors, and that is how I found out about this. However, PayPal told me to change from v3 to v1. So I was wondering, would it be okay to change from it to v1…or is the recommended suggestion still to change from v3 to v4? I'm not sure which to do now. Thanks for any suggestions. :)

DrByte:

If you update paypal_curl.php as advised, you shouldn't have any issues with Standard. I WOULD recommend applying the fix even if you haven't seen any problems yet.

I also use paypal payments standard. I just tested my site, and made a purchase with paypal and made a purchase with authorize.net credit card, and everything is working fine. Do you know why I would not be affected? Is it because I am using website payments standard?

What fix should people with paypal payments standard do? And we should do it even though there is no error??

oc-flyfish:

I called PayPal this morning, as soon as I received 7 PayPal Express Checkout errors, and that is how I found out about this. However, PayPal told me to change from v3 to v1. So I was wondering, would it be okay to change from it to v1…or is the recommended suggestion still to change from v3 to v4? I'm not sure which to do now. Thanks for any suggestions. :)

Just personal opinion, but if your host supports V4 then that will probably be the preferred option. Better to move forward than backward I reckon.

Cheers
Rod

philip937:

I've made the suggested change. I'll switch back if I notice any issues using the setting on standard.

Ps - the only reason I knew about the issue was because I received an email from Numinix. They are suggesting changing value from 3 to 1..

I think I'll take my advice from here.

oc-flyfish:

I called PayPal this morning, as soon as I received 7 PayPal Express Checkout errors, and that is how I found out about this. However, PayPal told me to change from v3 to v1. So I was wondering, would it be okay to change from it to v1…or is the recommended suggestion still to change from v3 to v4? I'm not sure which to do now. Thanks for any suggestions. :)

I WOULD NOT CHANGE IT TO v1.

SSL v3 IS NOT THE SAME AS TLS v1

THERE IS A LOT OF CONFUSION IN THE PHP DOCUMENTATION and testing various approaches yields confusing results.

If you're uncomfortable with setting it to v4 (which technically doesn't yet exist), then simply comment-out the line, so that the version is auto-negotiated with the server. (Which is really the desired result anyway. The whole reason for specifying v3 initially was that v2 was deemed insecure but was the assumed default, but that has changed in modern PHP versions.)

The Dr has spoken! Cheers

Wow! I'm so glad I asked!!!! Thank you so much DrByte!! PayPal has really outdone themselves this time! Ha! Grrrrr....

What about USPS?

I have made the change to 4 and everything is back on track!

To underscore earlier praises, thank you so much for the quick and accurate response to this problem.

BTW, I also called PayPal this morning, and the tech told me outright that it was not a PayPal problem, but a selling platform problem, and that if I was paying for a website ( as opposed to using Zen Cart ), this would probably have been resolved before I had seen it appear. I felt dutifully spanked for my transgression, and slinked off into the sunset....

Anyway, thanks again - - - -you people are exceptional!

Phil
Heirlooms To Cherish

mprough:

What about USPS?
For USPS, if you're getting the same error, simply comment-out the CURLOPT_SSLVERSION line. I posted similarly in the Release Announcement earlier. I'll update it with more specific wording shortly.

(That said, I recall a time I was working with Ajeh where it actually needed v3 specified ... so change according to your server requirements, ie: whatever stops throwing any errors.)

Phil Soth:

if I was paying for a website ( as opposed to using Zen Cart ), this would probably have been resolved before I had seen it appear.

That's like the dumbest a$$ed remark the tech could have made.. I DO HOPE this foolish person tells one of their larger corporate clients who ALSO do not have any kind of "paying website" (because they have a tech dept that built their site) this SAME message..

SMH

DrByte:

I WOULD NOT CHANGE IT TO v1.

SSL v3 IS NOT THE SAME AS TLS v1

THERE IS A LOT OF CONFUSION IN THE PHP DOCUMENTATION and testing various approaches yields confusing results.

If you're uncomfortable with setting it to v4 (which technically doesn't yet exist), then simply comment-out the line, so that the version is auto-negotiated with the server. (Which is really the desired result anyway. The whole reason for specifying v3 initially was that v2 was deemed insecure but was the assumed default, but that has changed in modern PHP versions.)

FYI, I've changed our recommendation to simply comment out the CURLOPT_SSLVERSION instead of setting it to v4.

It's also worth noting that it appears as though PayPal may have recanted their aggressive block of all SSL3 connectivity to their live site, as connections are once again working fine (at this moment) using the original CURLOPT_SSLVERSION => 3 setting.

DivaVocals:

That's like the dumbest a$$ed remark the tech could have made.. I DO HOPE this foolish person tells one of their larger corporate clients who ALSO do not have any kind of "paying website" (because they have a tech dept that built their site) this SAME message..

SMH

Seconding That /\ /\ /\

How does this apply to authorizenet_aim.php? Didn't notice a separate thread for it and do see

curl_setopt($ch, CURLOPT_SSLVERSION, 3);

at my 576...

What's the move??

Thanks a bunch,
John

bumba000:

How does this apply to authorizenet_aim.php? Didn't notice a separate thread for it and do see

curl_setopt($ch, CURLOPT_SSLVERSION, 3);

at my 576...

What's the move??

Thanks a bunch,
John
IMO I'd leave it alone for now (I'm not seeing any errors with Authnet as-is right now), as even PayPal has apparently relaxed their initial hyper-protective rejection of all SSL3 connections. But if the same error pops up suddenly, simply comment out the line.

PP tech support told me it's only a 24 hr reprieve