PayPal IPN通知:SSL证书验证失败


PayPal IPN Notifications: SSL Certificate Verify Failed

在过去一周左右,我没有收到任何PayPal IPN通知。我在日志文件中得到的错误是:

[03-Apr-2015 00:16:00] cURL error: [60] SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

我采取的步骤:

  1. 我看到了之前关于这个的问题,并下载了cacert.pem文件
  2. 我更新了我的ipn-php文件中的证书名称
  3. 我检查了新证书和相关文件夹的权限,以确保它们都设置为读取和执行
  4. 我已经设置了以下内容:curl_setopt($ch, CURLOPT_SSLVERSION, 4);

我再次使用IPN模拟器进行测试,并继续得到相同的错误。还有什么想法吗?

以下是ipn侦听器代码:

<?php
class IpnListener {
    public $use_curl = true;     
    public $force_ssl_v3 = true;     
    public $follow_location = false;     
    public $use_ssl = true;      
    public $use_sandbox = true; 
    public $timeout = 30;       
    private $post_data = array();
    private $post_uri = '';     
    private $response_status = '';
    private $response = '';
    const PAYPAL_HOST = 'www.paypal.com';
    const SANDBOX_HOST = 'www.sandbox.paypal.com';
    protected function curlPost($encoded_data) {
        if ($this->use_ssl) {
            $uri = 'https://'.$this->getPaypalHost().'/cgi-bin/webscr';
            $this->post_uri = $uri;
        } else {
            $uri = 'http://'.$this->getPaypalHost().'/cgi-bin/webscr';
            $this->post_uri = $uri;
        }
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
        curl_setopt($ch, CURLOPT_CAINFO, 
                    dirname(__FILE__)."/cert/cacert.pem");
        curl_setopt($ch, CURLOPT_URL, $uri);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $encoded_data);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, $this->follow_location);
        curl_setopt($ch, CURLOPT_TIMEOUT, $this->timeout);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_HEADER, true);
        curl_setopt($ch, CURLOPT_SSLVERSION, 4);
        $this->response = curl_exec($ch);
        $this->response_status = strval(curl_getinfo($ch, CURLINFO_HTTP_CODE));
        if ($this->response === false || $this->response_status == '0') {
            $errno = curl_errno($ch);
            $errstr = curl_error($ch);
            throw new Exception("cURL error: [$errno] $errstr");
        }
    }
    protected function fsockPost($encoded_data) {
        if ($this->use_ssl) {
            $uri = 'ssl://'.$this->getPaypalHost();
            $port = '443';
            $this->post_uri = $uri.'/cgi-bin/webscr';
        } else {
            $uri = $this->getPaypalHost(); // no "http://" in call to fsockopen()
            $port = '80';
            $this->post_uri = 'http://'.$uri.'/cgi-bin/webscr';
        }
        $fp = fsockopen($uri, $port, $errno, $errstr, $this->timeout);
        if (!$fp) { 
            // fsockopen error
            throw new Exception("fsockopen error: [$errno] $errstr");
        } 
        $header = "POST /cgi-bin/webscr HTTP/1.1'r'n";
        $header .= "Host: ".$this->getPaypalHost()."'r'n";
        $header .= "Content-Type: application/x-www-form-urlencoded'r'n";
        $header .= "Content-Length: ".strlen($encoded_data)."'r'n";
        $header .= "Connection: Close'r'n'r'n";
        fputs($fp, $header.$encoded_data."'r'n'r'n");
        while(!feof($fp)) { 
            if (empty($this->response)) {
                // extract HTTP status from first line
                $this->response .= $status = fgets($fp, 1024); 
                $this->response_status = trim(substr($status, 9, 4));
            } else {
                $this->response .= fgets($fp, 1024); 
            }
        } 
        fclose($fp);
    }
    private function getPaypalHost() {
        if ($this->use_sandbox) return self::SANDBOX_HOST;
        else return self::PAYPAL_HOST;
    }
    public function getPostUri() {
        return $this->post_uri;
    }
    public function getResponse() {
        return $this->response;
    }
    public function getResponseStatus() {
        return $this->response_status;
    }
    public function getTextReport() {
        $r = '';
        // date and POST url
        for ($i=0; $i<80; $i++) { $r .= '-'; }
        $r .= "'n[".date('m/d/Y g:i A').'] - '.$this->getPostUri();
        if ($this->use_curl) $r .= " (curl)'n";
        else $r .= " (fsockopen)'n";
        // HTTP Response
        for ($i=0; $i<80; $i++) { $r .= '-'; }
        $r .= "'n{$this->getResponse()}'n";
        // POST vars
        for ($i=0; $i<80; $i++) { $r .= '-'; }
        $r .= "'n";
        foreach ($this->post_data as $key => $value) {
            $r .= str_pad($key, 25)."$value'n";
        }
        $r .= "'n'n";
        return $r;
    }
    public function processIpn($post_data=null) {
        $encoded_data = 'cmd=_notify-validate';
        if ($post_data === null) { 
            // use raw POST data 
            if (!empty($_POST)) {
                $this->post_data = $_POST;
                $encoded_data .= '&'.file_get_contents('php://input');
            } else {
                throw new Exception("No POST data found.");
            }
        } else { 
            // use provided data array
            $this->post_data = $post_data;
            foreach ($this->post_data as $key => $value) {
                $encoded_data .= "&$key=".urlencode($value);
            }
        }
        if ($this->use_curl) $this->curlPost($encoded_data); 
        else $this->fsockPost($encoded_data);
        if (strpos($this->response_status, '200') === false) {
            throw new Exception("Invalid response status: ".$this->response_status);
        }
        if (strpos($this->response, "VERIFIED") !== false) {
            return true;
        } elseif (strpos($this->response, "INVALID") !== false) {
            return false;
        } else {
            throw new Exception("Unexpected response from PayPal.");
        }
    }
    public function requirePostMethod() {
        // require POST requests
        if ($_SERVER['REQUEST_METHOD'] && $_SERVER['REQUEST_METHOD'] != 'POST') {
            header('Allow: POST', true, 405);
            throw new Exception("Invalid HTTP request method.");
        }
    }
}

您可能希望删除CURLOPT_CAINFO选项,而将CURLOPT_SSL_VERIFYPEER设置为false。这里有一个例子:

$request = curl_init();
curl_setopt_array($request, array
(
  CURLOPT_URL => $url,
  CURLOPT_POST => TRUE,
  CURLOPT_POSTFIELDS => http_build_query(array('cmd'=>'_notify_validate') + $_POST),
  CURLOPT_RETURNTRANSFER => TRUE,
  CURLOPT_HEADER => FALSE,
  CURLOPT_SSL_VERIFYPEER => FALSE,
));

我也遇到了同样的问题。旧的ssl库似乎与新的cacert.pem有问题。通过使用"github中的旧ca捆绑包"(RSA-1024删除之前转换的最后一个ca捆绑包)解决:https://github.com/bagder/ca-bundle/blob/e9175fec5d0c4d42de24ed6d84a06d504d5e5a09/ca-bundle.crt

我能够通过恢复到我的旧证书文件并将"VeriSign class 3 Public Primary Certification Authority-G5"证书部分粘贴到其中(从cacert.pem)来解决这个问题。这感觉有点像黑客攻击,但我在引用cacert.pem时无法使其工作。

在安全方面,我觉得将verify peer设置为false并不舒服。

感谢大家的想法和建议。