PayPal Sandbox Blocks WinHTTP.WinHTTPRequest.5.1

Question

paypalfunctions.asp and expresscheckout.asp files

I'm hoping to find help, and if not help then a developer for hire who is proficient in Classic ASP and PayPal and can help me resolve this.

We have a Windows 2008 R2 Server running Classic ASP. We have been sandbox testing development for over a year now and recently all PayPal Express Checkout "posts" seem to have stopped and now when you click the buttons to take you to expresscheckout the screen goes blank. White. Returns absolutely nothing.

So this would mean that either PayPal seems to have stopped or changed the way its working with WinHTTP.WinHTTPRequest.5.1 or our server has somehow updated itself?

PayPal is using WinHTTPRequest.5.1 in Classic ASP for sending NVP's with its Express Checkout.

We are using Classic ASP with IPN notification with API Signature.

When On Error Resume Next is removed in paypalfunctions.asp I get the following error;

500 Error - Description: An error occurred in the secure channel support.
Error Code: 80072f7d. Line: 176

Adding

objHTTP.Option(9) = 128 

to the WinHTTP Request and

response.write(nvpStrComplete) 

returns

METHOD=SetExpressCheckout&VERSION=93&USER=sdk%2Dthree%5Fapi1%2Esdk%2Ecom&PWD=QFZ
CWN5HZM8VBG7Q&SIGNATURE=A%2DIzJhZZjhg29XQ2qnhapuwxIDzyAZQ92FRP5dqBzVesOkzbdUONzm
OU&L%5FPAYMENTREQUEST%5F0%5FNAME0=My Order&L%5FPAYMENTREQUEST%5F0%5FDESC0=My 
Item&L%5FPAYMENTREQUEST%5F0%5FAMT0=4&L%5FPAYMENTREQUEST%5F0%5FNAME1=Handling 
Fee&L%5FPAYMENTREQUEST%5F0%5FAMT1=0%2E42&PAYMENTREQUEST%5F0%5FPAYMENTACTION=Sale
&PAYMENTREQUEST%5F0%5FCURRENCYCODE=USD&PAYMENTREQUEST%5F0%5FAMT=4%2E42&RETURNURL
=http%3A%2F%2Fwww%mysite%2Ecom%2F%23paymentcomplete&CANCELURL=http%3A%2F%2Fwww%2
Emysite%2Ecom%2F%23paymentcancel&ALLOWNOTE=0&BUTTONSOURCE=PP%2DECWizard

This looks ok to me?

Does anyone know how I can workaround WinHTTP.WinHTTPRequest.5.1 using the paypalfunctions.asp standard output Wizard Integration code?

Or if not and this is no longer an option can recommend a professional and competent Classic ASP / PayPal developer so he/ she can work/ revise with our existing code?

Answer 1

Just to summarise the comments.

The error points to an issue with the secure channel which often is related to the wrong protocol being used to call the endpoint.

This does not mean that the WinHTTP.WinHTTPRequest.5.1 doesn't work it just means the wrong protocol is being used to make the HTTP request.

Due to the POODLE internet security vunerability in SSL 3.0 PayPal informed their users that support for SSL 3.0 would be disabled starting with the SandBox.

_{Quote from PayPal - Required security update}

How is PayPal responding?

PayPal will completely disable SSL 3.0 support in a timeframe to be announced via PayPal Notify; however, based on security monitoring, we may need to move quickly to protect our customers so time is of the essence in making changes. Unfortunately, we realize shutting off SSL 3.0 may cause compatibility problems for a few of our customers resulting in the inability to pay with PayPal on some merchant sites or other processing issues that we are still identifying. To enable your assessment and potential remediation, we’ve put together this Merchant Response Guide to ensure your integration is secure from this vulnerability.

The workaround is to use TLS which should allow you to connect to the endpoint without a problem.

You can do this using the WINHTTP_OPTION_SECURITY_FLAGS with the Option property of the WinHttp.WinHTTPRequest.5.1 object.

'The WINHTTP_OPTION_SECURITY_FLAGS option
Const WinHttpRequestOption_SecureProtocols = 9

'Valid WINHTTP_OPTION_SECURITY_FLAGS option flags
Const SecureProtocol_SSL2   = 8       'SSL 2.0
Const SecureProtocol_SSL3   = 32      'SSL 3.0
Const SecureProtocol_TLS1   = 128     'TLS 1.0
Const SecureProtocol_TLS1_1 = 512     'TLS 1.1
const SecureProtocol_TLS1_2 = 2048    'TLS 1.2

You can then modify your WinHttp object (assuming the object is called winhttp) like so to switch the secure protocol;

winhttp.Option(WinHttpRequestOption_SecureProtocols) = SecureProtocol_TLS1_2

Note: Some versions of Windows Server do not support the SecureProtocol_TLS1_2 flag or may require an hotfix. It really depends on what version of winhttp.dll is installed on the system.

---

Useful Links

• Classic ASP / IIS6 / Win2003 Server can't communicate with TLS server
• WinHttp errors on option 9 / Win2008 / Classic ASP
• WinHttpRequest object