java - POODLE 更新后，PayPal IPN 停止使用 Tomcat/Open SSL

Question

在 PayPal 进行更改以应对 POODLE 漏洞 (link) 后，PayPal IPN 消息停止通过。

我们正在运行 Java 1.6 和 Tomcat 6。

Answer 1

PayPal 调查了这个问题，这里是响应:

The issue could be related to the web server your using (Tomcat) and the implementation of ciphers in Open SSL 1.0.

When testing your IPN URL using CURL, we are receiving the following error "error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error"

This appears to be an issue with Open SSL 1.0 and Tomcat, as outlined in the following article - http://georgik.sinusgear.com/2012/02/19/tomcat-7-and-curl-ssl23_get_server_hellotlsv1-alert-internal-error/

因此我们修改了 tomcat server.xml 使其具有以下内容:

ciphers="SSL_RSA_WITH_RC4_128_SHA"

然后 PayPal IPN 又开始工作了。