Instant Payment Notification change from PayPal

[feemish]

thanks for pointing that out

[malbro]

Paypal are sending out new letters which include extra information

In a bulletin dated the 18th of October, 2011, we announced that we were going to expand the number of IP addresses for www.paypal.com to improve our site’s performance, scalability and availability. As part of this transition, we planned to discontinue support for HTTP 1.0 protocol starting the 7th of October, 2013.

We have recently identified that this change may impact the ability of some of our merchants to perform IPN (Instant Payment Notification) post-back validation or PDT (Payment Data Transfer) posts to www.paypal.com and ipnpb.paypal.com. This happens when the IPN or PDT scripts use HTTP 1.0 protocol and do not include the “Host: www.paypal.com” or “Host: ipnpb.paypal.com” header in the HTTP request.

This is a new implementation date and appears to require more information in the header, is the fix above still all we need.

[feemish]

Also this came through yesterday;

In keeping with industry standards set by the Certification Authority/Browser (CA/B) Forum, PayPal will discontinue supporting 1024-bit key length certificates and will migrate to 2048-bit certificates before the end of 2013.
We have completed the installation of 2048-bit certificates for all API endpoints in our PayPal Sandbox and Payflow Pilot environments, and we will be doing the same for our production environments starting on 6 August 2013.
We strongly encourage merchants to thoroughly test any existing integration(s) in the PayPal Sandbox and/or Payflow Pilot environments to ensure this migration will not cause any unforeseen issues.
Please have the team or person responsible for your integration refer to the following:

If you need to import the new PayPal Sandbox and/or Payflow Pilot server certificates to your application or system truststore, you can download production and Sandbox certificates from https://ppmts.custhelp.com/app/answers/detail/a_id/952.
If you don't typically import the server certificates to your truststore, you can proceed with testing with no other action required.
If you have any questions, please contact PayPal Merchant Technical Services by filing a ticket; refer to PP-LIVE-3503. You may also visit our Live Site Status blog.
Yours sincerely,
PayPal

[Barry]

only 3 weeks away now!

Hi folks

Is there any update on this? We are just over 3 weeks away from this update now and I havent heard anything about it.

Should I be concerned?

[Duncan Rounding]

The fix is here: http://community.sellerdeck.com/show...206#post337206

[Barry]

Thanks Duncan

We are on V11.0.1, do you think we need to upgrade before intalling this fix to 11.0.3 as listed in the page you linked to?

If possible I'd like to avoid that as we have had such problems in teh past upgrading and of course it means we have to update all our clients installations too. Could be a lot of work.

What do you think? Is 11.0.3 a requirement for this patch?

Thanks Duncan

[Duncan Rounding]

To be sure you could check the specific differences in the modified Actinic.pm linked to on that page and then apply them to your 11.0.1 version. You should hopefully be able to distinguish between the Paypal changes and any other updates between 11.0.1 and 11.0.3. If not then you will need the stock 11.0.3 file to compare against.

[Duncan Rounding]

There's only two small changes made to the Actinic.pm file between the v11.0.3 original and then modified for the new protocol. You should be able to add these changes in to the v11.0.1 version quite easily. See attached.