my client's website has v1.6.4 of Expresso Store. I integrated it into EE some years ago. Recently, users of his website have experienced problems with the checkout process, which is using Paypal Express Checkout. It appears Paypal has changed some security stuff (they moved to SHA-256), and has warned my client about it via email. The email says something about IPN, but frankly the translation into italian lacks clarity. Is someone else among the readers here affected by the Paypal changes, and willing to help?

Thank you! Carlo


Here's the email from PayPal:

As we have previously communicated to you, PayPal is upgrading the certificate for www.paypal.com to SHA-256. This endpoint is also used by merchants using the Instant Payment Notification (IPN) product.
This upgrade is scheduled for 9/30/2015; however, we may need to change this date on short notice to you to align to the industry security standard.
You’re receiving this notification because you’ve been identified as a merchant who has used IPN endpoints within the past year. If you have not made the necessary changes, we urge you to do so right away to avoid a disruption of your service!
Because these changes are technical in nature, we advise that you consult with your individuals responsible for your PayPal integration. They will be able to identify what, if any, changes are needed. Please share this email and the hyperlinks below with your technical contact for evaluation.
Testing in the Sandbox is one of the best ways to make sure your integration works. Sandbox endpoints have been upgraded to accept secure connections by the SHA-256 Certificates.
Full technical details can be found in our Merchant Security System Upgrade Guide. In addition, our 2015-2016 SSL Certificate Change microsite contains a schedule of our service upgrade plan.
Thanks for your patience as we continue to improve our services.

  • 1.6.4 is a few years old. Have them contract you to upgrade their Store version. – jrothafer Oct 1 '15 at 15:58
  • PayPal Express gateway does not use an IPN but PayPal Standard gateway does, can you confirm that you are indeed using PPE since both standard and expres shipped with Store 1.x – Justin Long Oct 1 '15 at 16:15
  • @JustinLong yes, I'm using PPE. We just tried to replicate the error by buying a fake product priced 0.01€ and we encountered no errors. So, probably the user having problems was caused by other issues. Still, I don't understand why Paypal sent the warning email about the changes in the service. I managed to find it in english and updated the thread above. Any idea? – Carlo Oct 1 '15 at 22:21
  • @Carlo, PayPal Express does not use an IPN to validate that an order has been completed so this should not apply to you if you are using the PayPal Express gateway. As to why you are needing to update this is for a couple of reasons most notably the industry as a whole is moving away from 1024 bit to 2048 bit certificates to help with security, along these lines SHA-1 is being depreciated in browsers soon (I think in Chrome by the end of the year) in favor of stronger SHA-2 algorithms. PayPal announced the transition earlier this year in May or June in their developer blog. – Justin Long Oct 1 '15 at 23:21
  • I have not used PayPal in a couple of years, but if your gateway is asking for an IPN URL then you should disable the PayPal gateway and upgrade to the latest 1x version of Store 1.6.5 and reenable the gateway. You should then have Username, Password & Signature fields to reenter (these are not your login details for PayPal but are in the account section under API). – Justin Long Oct 1 '15 at 23:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.