0

Using this code (pasted from this tutorial), I get a successful PayPal DoDirectPayment method execution. Note that CURLOPT_SSL_VERIFYPEER is set to FALSE.

However when I set the normal value (CURLOPT_SSL_VERIFYPEER = TRUE) I get no response from PayPal, not even a failure response, despite the fact that my code operates on a server with a working SSL certificate (all pages work with HTTPS URLs).

Anybody knows what could cause this problem ?

drake035
  • 3,955
  • 41
  • 119
  • 229
  • Could you provide any additional information about your certificate? If it doesnt work when you set CURL_SSL_VERIFYPEER = TRUE it might be because your using a self-signed certificate? For an explanation of CURLOPT_SSL_VERIFYPEER and HOST look here: http://stackoverflow.com/questions/4660610/if-curlopt-ssl-verifypeer-is-false-is-the-data-transfer-no-longer-secure – am_ Feb 20 '13 at 18:48
  • cacert.pem was missing, see http://stackoverflow.com/questions/14914330/security-consequences-of-disabling-curlopt-ssl-verifypeer-libcurl-openssl – drake035 Feb 20 '13 at 19:20
  • Ok, that was what I suggested in my answer below - to make sure you saved the PEM file in the valid format. – am_ Feb 20 '13 at 19:37

1 Answers1

0

If you are using a valid certificate and the problem still exists, you might need to doublecheck that you saved the CA in a valid format (X.509 Certificate PEM). I see you have exported your CA to a file called cacert.pem - make sure that this fle is valid, and that curl is indeed able to retrieve this file (valid path etc.)

You could try to export the certificate again - from a browser (ie: firefox), this can be done by visiting the PayPal https url in a browser (ie: Firefox) - and viewing the certicate and then exporting it. (make sure you use the correct format as stated earlier - X.509 Certificate PEM).

After saving the CA you then pass this on to the CURLOPT_CAINFO param as you already have:

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_CAINFO, getcwd() . "/CAcerts/BuiltinObjectToken-EquifaxSecureCA.crt");

For a more detailed explanation visit this great article: http://unitstep.net/blog/2009/05/05/using-curl-in-php-to-access-https-ssltls-protected-sites/

Quoting last part about the certficate:

If you have the CA certificate, but it is not in the PEM format (i.e. it is in a binary or DER format that isn’t Base64-encoded), you’ll need to use something like OpenSSL to convert it to the PEM format.

EDIT - If you get an error after exporting the certificate, you could also try to save the certificate using X.509 Certificate PEM (with chain)

am_
  • 2,378
  • 1
  • 21
  • 28