GoDaddy PayPal error - (77) error setting certificate verify locations

At 10am GMT I began to get the following alerts in my store:

ALERT: PayPal Express Checkout Error ()

• (77) error setting certificate verify locations: CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none

My host (Go Daddy...I know :blush:), looked into it and came back saying it was my zencart code that hadn't been updated after the SSL3 changes they recently made.

But, I had already updated my site according to the Poodle zencart instructions, when it all happened the other week. Everything has been running OK until 10am today.

Anyone else having these issues with PayPal?

From what I am seeing this is a godaddy issue ... best to contact tech support ... everything I have that uses CURL fails on my test sites too ...

Hi, thanks for replying...can you tell me what it is you see that makes it a GoDaddy issue, so I can sound like I know what I'm talking about? They already looked into it and said it's not them, everything is working as it should, and that it's my zencart code.

Hate it when I get caught up in this kind of ping-pong :(

Zen Cart doesn't do anything to set or define certificate authority (CA) settings. That's entirely up to the server administrator (in your case GoDaddy tech staff) to make sure is correct.

It's not a Zen Cart issue. Zen Cart is merely exposing the fact that your server is misconfigured.

What's your website URL? I'd like to pass it along to my GoDaddy contact in case that can help escalate for a solution.
What happens when you visit www.your_site.com/extras/curltester.php ? Give that complete URL to GoDaddy tech support when you're talking to them, so they can see that it's a server configuration problem.

DrByte:

What's your website URL? I'd like to pass it along to my GoDaddy contact in case that can help escalate for a solution.
What happens when you visit www.your_site.com/extras/curltester.php ? Give that complete URL to GoDaddy tech support when you're talking to them, so they can see that it's a server configuration problem.

Fyi, some action will have to be taken to support calling that function directly from that path. The tech support should be able to overcome it, but experience has proven that the contents of the extras directory have some security precautions in place to prevent/minimize access by outside prying eyes.

Hello, really appreciate your input and help!

My URL is https://printable-craftshop.com

re the curltester URL, yeah I got

"you don't have permission to access /boutique/extras/curltester.php on this server."

This is an .htaccess issue with godaddy servers ...

In the /extras directory you will see the .htaccess you need to edit that at the bottom:

OPTIONS -Indexes -ExecCGI

to read:

OPTIONS -Indexes

mc12345678:

Fyi, some action will have to be taken to support calling that function directly from that path. The tech support should be able to overcome it, but experience has proven that the contents of the extras directory have some security precautions in place to prevent/minimize access by outside prying eyes.
Only on hosts who are running PHP-as-CGI, like GoDaddy. Other hosts should be fine.

DrByte:

Only on hosts who are running PHP-as-CGI, like GoDaddy. Other hosts should be fine.

Thank you for the explanation of the specific "setting" that causes this issue. Add FatCow onto that "list" if PHP-as-CGI is the only direct setting that doesn't play well with the .htaccess -ExecCGI setting.

mc12345678:

DrByte:

Only on hosts who are running PHP-as-CGI, like GoDaddy. Other hosts should be fine.
Thank you for the explanation of the specific "setting" that causes this issue. Add FatCow onto that "list" if PHP-as-CGI is the only direct setting that doesn't play well with the .htaccess -ExecCGI setting.
Additional insight: Most hosts who offer end-users a choice of PHP versions do so by running PHP as CGI, instead of as an Apache module.

I, too, use godaddy, and I am getting the same problem (reported to me today by a would-have-been-customer).

I called godaddy, and they had no idea what was going on, and I found this thread while on hold with them...

FYI, I received an email from godaddy a day or so ago stating something about that due to security vulnerability they were changing something about my security cerfiticate.

I followed the fix listed in this thread, but it did not fix the issue, but at least now I can run the curltester:

Testing communications to various destinations. This is a simple diagnostic to determine whether your server can connect to common destinations.
For advanced "details" mode, add ?details=on to the URL.
Connecting to Zen Cart Support Server (http) ...
GOOD: CURL Connection successful.

Connecting to Zen Cart Support Server (https) ...
Error 77: error setting certificate verify locations: CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none

Connecting to USPS (port 80)...
GOOD: CURL Connection successful.

Connecting to USPS Test/Staging/Sandbox Server (port 80)...
GOOD: CURL Connection successful.

Connecting to UPS (port 80)...
GOOD: Socket established

Connecting to FedEx (port 80)...
GOOD: Socket established

Connecting to PayPal IPN (port 443)...
GOOD: Socket established

Connecting to PayPal Express/Pro Server ...
Error 77: error setting certificate verify locations: CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none

Connecting to PayPal Express/Pro Sandbox ...
Error 77: error setting certificate verify locations: CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none

Connecting to PayPal Payflowpro Server ...
Error 77: error setting certificate verify locations: CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none

Connecting to AuthorizeNet Production Server ...
Error 77: error setting certificate verify locations: CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none

Connecting to AuthorizeNet Developer/Sandbox Server ...
Error 77: error setting certificate verify locations: CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none

Connecting to LinkPointAPI server (port 1129)...
Error 28: Connection timed out after 5000 milliseconds

Testing completed. See results above.

====================

I do see that there are multiple .htaccess files... is the fix to go and try to find all of them and edit all of them???

Any godaddy clients like myself get the issue completely fixed yet?

UPDATE - called back and godaddy said that the security certificate would have to be rekeyed. They walked me through clicking to do it, and said that it could take up to 24 hrs...

UPDATE: called godaddy back and they said it's a result of my paypal settings, and that I need a new paypal button.

Really? A new paypal button?

?

stiggybaby:

UPDATE: called godaddy back and they said it's a result of my paypal settings, and that I need a new paypal button.

Really? A new paypal button?

?

Forgive me, but why the callback to address the issue that they said may take up to 24 hours? Yes, obviously the individual with whom you spoke isn't familiar with the workings of ZC and how it communicates with PayPal nor do they understand what the error messages are telling them. Absent those details and having to work the "front line" it doesn't seem to me to be an unheard of response. Wrong, but one might incorrectly draw that conclusion if only skimming the surface of all that has gone on in the last week or so...

I did not need to change any settings but my GoDaddy accounts do appear to be working now ...

Ajeh:

I did not need to change any settings but my GoDaddy accounts do appear to be working now ...

So basically, you just made a change to the .htaccess file in extras so you could run the curltester, then waited and tried to checkout and it began working again just fine on it's own?

Yeps ... we did talk to GoDaddy and tell them that things were broken on their servers but I did not have to change anything ...

NOTE: Be sure that you have kept up to date on the Poodle issue
http://www.zen-cart.com/showthread.php?214916-Important-announcement-about-POODLE-and-payment-security

NOTE: you should subscribe to the News & Announcement Forum if you have not already:
http://www.zen-cart.com/forumdisplay.php?2-Zen-Cart-Release-Announcements

Ajeh:

Yeps ... we did talk to GoDaddy and tell them that things were broken on their servers but I did not have to change anything ...

NOTE: Be sure that you have kept up to date on the Poodle issue
http://www.zen-cart.com/showthread.php?214916-Important-announcement-about-POODLE-and-payment-security

NOTE: you should subscribe to the News & Announcement Forum if you have not already:
http://www.zen-cart.com/forumdisplay.php?2-Zen-Cart-Release-Announcements

I did find the POODLE announcement while looking for a fix to this problem, and I did edit and comment out in both the paypaldp.php and paypal_curl.php
files.

59 minutes later I was told that my security cert was fine and that 2 different agents in the security cert dept BOTH insist that I need a new paypal button.

I even email them a link to this thread and emailed them the curltester results page and pointed out that the error is the same in authorize.net, but it was simply an hour completely wasted...

Well, I have to wonder if made changes while they checked into things for you and just didn't communicate to you that they fixed something on their end, or what??? I do know that I'm losing sales and possible customer trust...

PS thanks for the subscribe suggestion. I didn't notice the subscribe link until you pointed it out.

1. The /extras/.htaccess HAS NOTHING TO DO WITH THE CURL ERROR
   The ONLY reason the /extras/.htaccess file was mentioned is because of a safety protection in it to prevent hackers from abusing files in the /extras/ folder.
   So, removing the -ExecCGI part from the /extras/.htaccess file is ONLY to allow you to access the curltester.php script. THAT'S ALL IT DOES.
   And don't touch any other .htaccess files.

2. The "77" error is a misconfiguration bug in GoDaddy's servers. Tell their tech support agent to escalate the ticket to the highest level tech department ... because the staff in that department are fully informed of the issue and are working on a fix.

3. As for the POODLE fix, you SHOULD still proceed with making the fix posted in the Announcement at http://www.zen-cart.com/showthread.php?214916-Important-announcement-about-POODLE-and-payment-security