Guys, I have just logged into my PayPal to receiev a notice that I need to change my security settings (mainly IPN) due to the upgrades coming in 2017.
It felt like this was a generic notification, but I want to check if we need to do anything on our PayPal side.
I have read the notification you sent on your website regarding the 2016 changes, but I don’t see anything regarding the 2017 changes.
From PayPal today:
"PayPal is in the process of upgrading the SSL certificates used to secure our web sites and API endpoints. These new certificates will be signed using the SHA-256 algorithm and VeriSign’s 2048-bit G5 Root Certificate. You will need to ensure that your environment supports the use of the SHA-256 signing algorithm and discontinue the use of SSL connections that rely on the VeriSign G2 Root Certificate. For information, click HERE.
Act now to avoid any disruption of service. Testing will occur between June 17 and September 30, 2016.
PayPal is upgrading the protocols used to secure all external connections made to our systems. Transport Layer Security version 1.2 (TLS 1.2) and Hypertext Transfer Protocol version 1.1 (HTTP/1.1) will become mandatory for communication with PayPal in 2017. You will need to verify that your environment supports TLS 1.2 and HTTP/1.1, and if necessary make appropriate updates. For information, click HERE.
DATE CHANGE - Act by June 30, 2017
If you are using PayPal’s Instant Payment Notification (IPN) service, you will need to ensure that HTTPS is used when posting the message back to PayPal for verification. HTTP postbacks will no longer be supported. For information, click HERE.
DATE CHANGE - Act by June 30, 2017
PayPal will no longer support the use of the GET HTTP request method for our classic NVP/SOAP APIs. If you currently use any of these APIs, you will need to ensure that your API requests only use the POST HTTP request method. For information, click HERE.
DATE CHANGE - Act by June 30, 2017
The API certificate credentials issued by PayPal for use with the Classic API are being upgraded to SHA-256 signed 2048-bit certificates. If you currently connect to PayPal using API certificate credentials, you will need to generate a new API certificate via your account profile and use it for all API requests. For information, click HERE.
Act by January 1, 2018 (depending on your certificate expiration date)
Completed Items
If your integration is set up to systematically exchange files with PayPal’s Secure FTP Reporting / Batch Servers, please note that the IP addresses for these servers have changed. If your integration is hardcoded to the previous IP addresses, you will need to upgrade immediately to avoid any disruption of service. For information, click HERE."