PayPal IPN通知：SSL证书验证失败

问题描述：

在上周左右，我还没有收到任何PayPal IPN通知。我在日志文件中得到的错误是：PayPal IPN通知：SSL证书验证失败

[03-Apr-2015 00:16:00] cURL error: [60] SSL certificate problem, verify that the CA cert is OK. Details: 
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

步骤我已经采取了：

我看到这个previous question和下载的文件cacert.pem。
我更新了我的ipn php文件中的证书名称。
我检查了新证书和关联文件夹的权限，以确保它们都设置为读取和执行。
我已经设置如下：curl_setopt($ch, CURLOPT_SSLVERSION, 4);

我再次测试使用IPN模拟器，并继续得到同样的错误。任何想法可能需要在这里？

这里是IPN监听器代码：

<?php 

class IpnListener { 

    public $use_curl = true;  
    public $force_ssl_v3 = true;  
    public $follow_location = false;  
    public $use_ssl = true;  
    public $use_sandbox = true; 
    public $timeout = 30;  

    private $post_data = array(); 
    private $post_uri = '';  
    private $response_status = ''; 
    private $response = ''; 

    const PAYPAL_HOST = 'www.paypal.com'; 
    const SANDBOX_HOST = 'www.sandbox.paypal.com'; 

    protected function curlPost($encoded_data) { 

     if ($this->use_ssl) { 
      $uri = 'https://'.$this->getPaypalHost().'/cgi-bin/webscr'; 
      $this->post_uri = $uri; 
     } else { 
      $uri = 'http://'.$this->getPaypalHost().'/cgi-bin/webscr'; 
      $this->post_uri = $uri; 
     } 

     $ch = curl_init(); 

     curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); 
     curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2); 
     curl_setopt($ch, CURLOPT_CAINFO, 
        dirname(__FILE__)."/cert/cacert.pem"); 

     curl_setopt($ch, CURLOPT_URL, $uri); 
     curl_setopt($ch, CURLOPT_POST, true); 
     curl_setopt($ch, CURLOPT_POSTFIELDS, $encoded_data); 
     curl_setopt($ch, CURLOPT_FOLLOWLOCATION, $this->follow_location); 
     curl_setopt($ch, CURLOPT_TIMEOUT, $this->timeout); 
     curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); 
     curl_setopt($ch, CURLOPT_HEADER, true); 
     curl_setopt($ch, CURLOPT_SSLVERSION, 4); 

     $this->response = curl_exec($ch); 
     $this->response_status = strval(curl_getinfo($ch, CURLINFO_HTTP_CODE)); 

     if ($this->response === false || $this->response_status == '0') { 
      $errno = curl_errno($ch); 
      $errstr = curl_error($ch); 
      throw new Exception("cURL error: [$errno] $errstr"); 
     } 
    } 

    protected function fsockPost($encoded_data) { 

     if ($this->use_ssl) { 
      $uri = 'ssl://'.$this->getPaypalHost(); 
      $port = '443'; 
      $this->post_uri = $uri.'/cgi-bin/webscr'; 
     } else { 
      $uri = $this->getPaypalHost(); // no "http://" in call to fsockopen() 
      $port = '80'; 
      $this->post_uri = 'http://'.$uri.'/cgi-bin/webscr'; 
     } 

     $fp = fsockopen($uri, $port, $errno, $errstr, $this->timeout); 

     if (!$fp) { 
      // fsockopen error 
      throw new Exception("fsockopen error: [$errno] $errstr"); 
     } 

     $header = "POST /cgi-bin/webscr HTTP/1.1\r\n"; 
     $header .= "Host: ".$this->getPaypalHost()."\r\n"; 
     $header .= "Content-Type: application/x-www-form-urlencoded\r\n"; 
     $header .= "Content-Length: ".strlen($encoded_data)."\r\n"; 
     $header .= "Connection: Close\r\n\r\n"; 

     fputs($fp, $header.$encoded_data."\r\n\r\n"); 

     while(!feof($fp)) { 
      if (empty($this->response)) { 
       // extract HTTP status from first line 
       $this->response .= $status = fgets($fp, 1024); 
       $this->response_status = trim(substr($status, 9, 4)); 
      } else { 
       $this->response .= fgets($fp, 1024); 
      } 
     } 

     fclose($fp); 
    } 

    private function getPaypalHost() { 
     if ($this->use_sandbox) return self::SANDBOX_HOST; 
     else return self::PAYPAL_HOST; 
    } 

    public function getPostUri() { 
     return $this->post_uri; 
    } 

    public function getResponse() { 
     return $this->response; 
    } 

    public function getResponseStatus() { 
     return $this->response_status; 
    } 

    public function getTextReport() { 

     $r = ''; 

     // date and POST url 
     for ($i=0; $i<80; $i++) { $r .= '-'; } 
     $r .= "\n[".date('m/d/Y g:i A').'] - '.$this->getPostUri(); 
     if ($this->use_curl) $r .= " (curl)\n"; 
     else $r .= " (fsockopen)\n"; 

     // HTTP Response 
     for ($i=0; $i<80; $i++) { $r .= '-'; } 
     $r .= "\n{$this->getResponse()}\n"; 

     // POST vars 
     for ($i=0; $i<80; $i++) { $r .= '-'; } 
     $r .= "\n"; 

     foreach ($this->post_data as $key => $value) { 
      $r .= str_pad($key, 25)."$value\n"; 
     } 
     $r .= "\n\n"; 

     return $r; 
    } 

    public function processIpn($post_data=null) { 

     $encoded_data = 'cmd=_notify-validate'; 

     if ($post_data === null) { 
      // use raw POST data 
      if (!empty($_POST)) { 
       $this->post_data = $_POST; 
       $encoded_data .= '&'.file_get_contents('php://input'); 
      } else { 
       throw new Exception("No POST data found."); 
      } 
     } else { 
      // use provided data array 
      $this->post_data = $post_data; 

      foreach ($this->post_data as $key => $value) { 
       $encoded_data .= "&$key=".urlencode($value); 
      } 
     } 

     if ($this->use_curl) $this->curlPost($encoded_data); 
     else $this->fsockPost($encoded_data); 

     if (strpos($this->response_status, '200') === false) { 
      throw new Exception("Invalid response status: ".$this->response_status); 
     } 

     if (strpos($this->response, "VERIFIED") !== false) { 
      return true; 
     } elseif (strpos($this->response, "INVALID") !== false) { 
      return false; 
     } else { 
      throw new Exception("Unexpected response from PayPal."); 
     } 
    } 

    public function requirePostMethod() { 
     // require POST requests 
     if ($_SERVER['REQUEST_METHOD'] && $_SERVER['REQUEST_METHOD'] != 'POST') { 
      header('Allow: POST', true, 405); 
      throw new Exception("Invalid HTTP request method."); 
     } 
    } 
}

您可以发布您的IPN脚本，删除所有敏感信息吗？它应该只与证书有关，因为我可以通过替换证书来解决它。 – Eshan 2015-04-03 17:52:27

同样适用于我。您是否确信.pem证书是您目录中最新的证书。它必须在“VeriSign 3级公共主要认证机构 - G5”的某处。你可以在文本编辑器中打开你的Pem并查看这行吗？或者只需下载上述帖子中提到的证书并将其替换即可。 – Eshan 2015-04-04 22:06:40

答

我能够恢复到我以前的证书文件来解决这个问题，并粘贴“威瑞信3级公用主证书颁发机构 - G5”证书部分到它（从cacert.pem ）。这感觉有点像黑客，但是当我引用cacert.pem时，我却无法让它工作。

我不觉得舒适的安全智能设置验证对等为false。

谢谢各位的意见和建议。

答

您可能想要删除CURLOPT_CAINFO选项，而是设置CURLOPT_SSL_VERIFYPEER为false。这里有一个例子：

$request = curl_init(); 
curl_setopt_array($request, array 
(
    CURLOPT_URL => $url, 
    CURLOPT_POST => TRUE, 
    CURLOPT_POSTFIELDS => http_build_query(array('cmd'=>'_notify_validate') + $_POST), 
    CURLOPT_RETURNTRANSFER => TRUE, 
    CURLOPT_HEADER => FALSE, 
    CURLOPT_SSL_VERIFYPEER => FALSE, 
));

哇。我不知道PHP中的+符号是否像这样做了一个'array_merge（）'，但只有在将一个'array（）'语句附加到一个数组变量时。如果试图像'$ array1 + $ array2'这样做，他们只会得到'$ array1'。 – Volomike 2015-04-21 04:59:59

答

我有同样的问题。看起来旧的ssl库与新鲜的cacert.pem有问题。通过使用“来自github的旧版ca包”（从RSA-1024删除之前转换而来的最后一个CA包）解决： https://github.com/bagder/ca-bundle/blob/e9175fec5d0c4d42de24ed6d84a06d504d5e5a09/ca-bundle.crt

PayPal IPN通知：SSL证书验证失败

相关推荐