Magento 1.9 – Latest PayPal Upgrade Notification

magento-1.9paymentpaypal

Recently, our client got an email from PayPal regarding their service upgrade. I know about the SSL upgrade which took place around December 2014 due to poodle attack

I am unaware about this new upgrade, also i don't know if it will affect the payments on Magento website.

I read the documentation for System Upgrade provided by them. It suggests changes in the API and other stuffs. But i am not sure if these changes will affect Magento – PayPal integration.

If yes, will there be any upgrade patch released? I am sure, till now there is no upgrade patch released.

The mail my client received is as below:

PayPal service upgrades for merchants: You may need to take action.

We're contacting our merchants with some important information in
response to an industry-wide security upgrade, not unique to PayPal.
This change involves upgrading Secure Sockets Layer (SSL) certificates
over the course of 2015 and 2016.

Since these changes are technical in nature, we advise you to consult
your partner, website provider, or the people responsible for your
PayPal integration. They will be able to identify if any changes will
be needed. If you don't have a technology team, you should change
this, and we can work with them to ensure that you continue to process
payments through your current integration with PayPal. Full technical
details can be found in our Merchant Security System Upgrade Guide. In
addition, our 2015-2016 SSL Certificate Change microsite contains a
schedule of our service upgrade plan.

If you have any questions, please contact our Merchant Technical
Support team for technical support.

Thanks for your patience as we continue to improve our services.

It would be of great help, if someone can provide an insight on it.

EIDT

Our client got another email regarding it. The mail content is as
below:

As we have previously communicated to you, PayPal is upgrading the
certificate for www.paypal.com to SHA-256. This endpoint is also used
by merchants using the Instant Payment Notification (IPN) product.

This upgrade is scheduled for 30/9/2015; however, we may need to
change this date on short notice to you to align to the industry
security standard.

You’re receiving this notification because you’ve been identified as a
merchant who has used IPN endpoints within the past year. If you have
not made the necessary changes, we urge you to do so right away to
avoid a disruption of your service!

Because these changes are technical in nature, we advise that you
consult with your individuals responsible for your PayPal integration.
They will be able to identify what, if any, changes are needed. Please
share this email and the hyperlinks below with your technical contact
for evaluation.

Testing in the Sandbox is one of the best ways to make sure your
integrations work. Sandbox endpoints have been upgraded to accept
secure connections by the SHA-256 Certificates.

Full technical details can be found in our Merchant Security System
Upgrade Guide. In addition, our 2015-2016 SSL Certificate Change
microsite contains a schedule of our service upgrade plan.

Thanks for your patience as we continue to improve our services.

I am really confused if this in any way effect the integration of PayPal Standard or Express checkout with Magento. I am not a server expert to figure it out.

Can anyone please provide an insight on it.

Best Answer

I got this too. You're probably looking at this blog article, right? https://devblog.paypal.com/paypal-ssl-certificate-changes/

The translation is that they're going to use SSL certificates which have stronger encryption on them. All you need to do is make sure your server supports it. Which means - ask your hosting provider.

You actually shouldn't have to do anything in Magento itself. This is all server-level material. Magento itself doesn't actually do the encryption/decryption, it makes a call to the server which handles that.

To be 100% certain, call your hosting provider about this. Tell them that you got this email about paypal upgrading their SSL certs to SHA-256, and you want to make sure your server supports it.

Most likely, they'll tell you they upgraded months ago.