Paypal TLS1.2 - Any Luck Convincing Paypal?

[snorkelnut]

Hi All,

Paypal is now saying they will not allow us to process payments after June 30th if we are not compliant with the TLS1.2 security standard.

I know that E-junkie is compliant. That is not an issue.

My question is has anyone had luck when contacting Paypal in getting them to understand that the payments are not happening on your own hosted website? But are instead handled by e-junkie?

Our website has not yet been converted to a https secure site. Could that be an issue?

Thanks for any tips on dealing with this issue with Paypal.

[my3hens]

I’m wondering the same thing and having tbe same issues! I’d love to know too!

[mknight336]

I spoke with a representative at PayPal and they said this was "a blanket" letter sent to all merchants. If we (e-Junkie customers) are using a 2nd party for our transactions (like E-junkie) and "they are compliant" then we do not have anything to worry about. He looked up the E-Junkie site and said that there should not be a problem.

[snorkelnut]

Thanks. When did you talk with them? The letter we received in the mail yesterday was directed specifically to us, and did not read like a blanket letter. It said they had tried to contact us many times, and threatened we would not be able to process payments if we did not fix the issue. So, while I suspect it is still an automated letter, I still have concerns about the situation. I have contacted them, and got a silly response that made it clear they did not even read my email. I will most likely have to call.

[E-junkie_Guru]

Overnight on June 5th-6th, our Devs found and resolved one last remaining noncompliant point of our integration with PayPal. I sent our upper-level tech contact at PayPal a list of merchants who'd inquired about the latest round of warnings yesterday, and he has confirmed they show no remaining compliance violations logged after the 6th, so apparently the warnings in this latest round were generated due to issues logged prior to that date.

We are now fully confident about our compliance with PayPal's integration requirements, and as before, you won't need to do anything to ensure compliance or clear the air with PayPal; it's all handled at our end.

[sprudio]

Hi E-Junkie Guru,
is there a link where we can test if we are compliant. I to got a letter from paypal in which they say that tried to contact me for weeks.Also I am using old buttons since I am with e-junkie for 13 years is there any problem? I have a https website and lots of products will take a while to change all the buttons.

[E-junkie_Guru]

The only endpoints PayPal offers to test against are unfortunately only useful to backend developers, and it couldn't even catch the specific issue we found and resolved on the 5th-6th (if it could, we'd have found that problem sooner). It won't matter how old your E-junkie button codes are, nor whether your own site is using HTTPS or not, as your ecommerce solution (E-junkie) is not software installed on your own server; we handle all of the integration details at our end for you, so you won't need to do anything at all.

Ironically, that final issue we corrected had nothing to do with processing payments or sending checkouts to PayPal. It was in the routine we use to validate that the IPNs we receive confirming completed payments are indeed legit and generated by PayPal, so even if we hadn't updated that in time, all that would have happened is we'd have been temporarily unable to verify IPNs -- which is academic by now, since we fixed that.

[mknight336]

I received my letter yesterday (Monday the 11th) and called them today. My letter looked like it was specifically regarding my website also. The customer service guy said they were "blanket" letters, and if the 2nd party company (in our case E-Junkie) is compliant, we have nothing to worry about. My links are "on" the Ejunkie sight and not on my website, so it does make sense. this web security stuff is one of the reasons I went with a 2nd party digital delivery company.
Call PayPal, it did not take more then 5 minutes to clear-up and I was satisfied with what they said.

[adshap]

I just wanted to add to this. I also got the letter in the mail and called Paypal today (June 13), and they said the issue was with e-junkie's IPN.

But I'm assuming that the June 5-6th fix mentioned above in this thread solved this, and this warning they have hasn't been updated yet and is on a delay.

---

"Thank you for speaking with me today regarding PayPal's security updates and the change to TLSv1.2 that is happening later this month.

As we discussed on the call, you are currently using our IPN service and the postback from your IPN script is sending TLSv1.0

Please pass these details on to your E-Junkie team and let's see if they can identify what the issue is..."

[E-junkie_Guru]

Yes, that IPN issue they mentioned is the same one our Devs found and corrected overnight on the 5th-6th. If you received a physical letter in the mail (we've seen a few scans of these), note that the date on it is prior to the day we applied that fix. You can just disregard these warnings, as they were generated due to previous errors they'd logged prior to the fix.

[wonderland]

Dear ejunkie guru, I am a user from German and contacted PayPal Germany, also referencing this page. They said that ejunkie still needs to take action. Could you help?:

"Thank you for contacting the PayPal Merchant Technical Support.

Looking at the answer, I think you overlook the fact that your IPN Listener must not be located on your webserver.
So I looked up one of the IPN you receive form us.
According to your WPS Button requests, you ask us to send them to: https://www.e-junkie.com/ecom/291558/ipn_res_cart.php

Now thats your e-junkies partner who is doing your IPN Listener for you correct?
Which means they do the IPN Postbacks still in TLS 1.0. and because it is done through your request, we mark your account as one that is not updated yet.

It is good that you are on their forum already, perhaps they can help you with a time line as to when they upgrade their systems so that after 30th of June, you will still be able to receive IPN and thus update your ordering system."

[E-junkie_Guru]

Yes, that IPN listener is what we fixed on June 5th-6th; if you ask PayPal to check TLS violations for your account there, they should find all were logged prior to the 6th and none logged after.

[landro]

I received the same email today. I called PayPal and they determined it to be a issue with the IPN.

[E-junkie_Monster]

Hi Landro,

Even though we've confirmed the fix with PayPal ourselves, the IPN issue they're still telling people about is the one that was fixed on the fifth. They've confirmed to us that everything has been working since then, although it looks like that hasn't reached the front-line phone support...

[eileenbanderson]

May I ask if people have been successfully selling products via Paypal since July 1?

Just checking since I don't sell that many—so it would be a while for me to know if there were a problem.

Thanks,

Eileen Anderson

[E-junkie_Guru]

Everything appears to be working fine; we haven't seen any issues nor any sellers reporting trouble with PayPal since the deadline passed, so all should be well.

[nihonshock]

Not sure if it's related, but I got my first E-junkie transaction since the deadline today and although the payment came through OK the automatic delivery of the PDF seems to have failed. (customer contacted me)

Hope it's either just a one-time glitch, customer misunderstanding, or something E-junkie is already aware of.

Has anyone else had an issue?

[headhunter]

Our e-junkie has been handling PayPal payments and delivering downloads as of July 5 without a problem. Yet today (7/5) I got another notice when I logged into our PayPal account, implying we were not compliant. I know our web hosting service has confirmed our server is TLS1.2 and https 1.1 compliant. (We set up https a few months ago -- if you don't do that, you're gonna have problems.) Nice job, e-junkie! Always a rock-solid service with quick tech support turnaround!

[E-junkie_Guru]

PayPal has confirmed to us the warnings that appear on login to their site are due to issues they'd logged going back prior to June 5th, and that they are not seeing any issues logged since June 6th for any merchant we've asked them to check. The fact that you are still processing payments successfully now, after their cutoff deadline, confirms that things are set up and working as they require.

BTW, when you use E-junkie it's not necessary to upgrade your site to use HTTPS or TLS 1.2, as your own server is not interfacing with PayPal's system at all, nor is your site handling any payment data subject to PCI-DSS compliance requirements; we handle all of that for you at our end.

@nihonshock - If the payment completed at PayPal's end, that delivery issue your buyer reported would be unrelated to all this. We'd be glad to check your settings if you can email us the affected Transaction ID, but meanwhile the troubleshooting steps here should help you sort out the problem:

PayPal notified me of a payment, but E-junkie did not process the order.