Saturday, 21 July 2018

PayPal's recent TLS 1.2 / HTTP 1.1 updates and when to use it

With regards to Paypal's recent security update I have started adding two additional options to my cURL code, those being:

curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
curl_setopt($ch, CURLOPT_SSLVERSION, 6);

I set CURLOPT_HTTP_VERSION since not setting it seems to default to "lets CURL decide which version to use" - whilst I don't want or like to hardcode the setting for future compatibility reasons, can cURL be trusted to always set HTTP 1.1 if support is available?

Secondly, I set CURLOPT_SSLVERSION to 6, which is CURL_SSLVERSION_TLSv1_2 because I have read that..

Some environments may be capable of TLS 1.2 but it is not in their list of defaults, so need the SSL version option to be set.

Now, an additional query is I notice at that PayPal link it only makes mention of endpoints, but how about when you're making cURL requests to their other URL's like the common: https://www.paypal.com/cgi-bin/webscr used for things such as IPN listeners? Does that still require TLS 1.2 and HTTP 1.1?



from PayPal's recent TLS 1.2 / HTTP 1.1 updates and when to use it

No comments:

Post a Comment