Do I need a new PayPal API to support TLS 1.2 on .Net server?

Question

I am running ASP.Net 4.5, but using a very old version of the PayPal SOAP api. The reference is to paypal_base.dll with a reported version of 4.3.1.0. The code that calls the API has "using" statements that reference:

com.paypal.sdk.services

com.paypal.soap.api.

I have verified at the point where the call to the PayPal api is made, that this value

System.Net.ServicePointManager.SecurityProtocol

includes both ssl3 and tls1.2.

I am pointing at the "sandbox" mode.

But when the setExpressCheckout call is made, I get a runtime exception that says: The request was aborted: Could not create SSL/TLS secure channel.

I have downloaded the PayPal API Samples project and using the same sandbox credentials, it works. Looking in Fiddler, the calls are nearly identical except the samples API call goes to api-3t.sandbox.paypal.com, while my code goes to api-aa.sandbox.paypal.com, but according to the documentation on TLS 1.2 readyness, both apis should work. I don't see anywhere in either API to set the endpoint other than switching between "live" and "sandbox".

In the fiddler response, both show: "A SSLv3-compatible ServerHello handshake was found. Fiddler extracted the parameters below. Version: 3.3 (TLS/1.2)" And the responses are identical except for the "random" parameter. So the old API call is using TLS 1.2

My code and the Samples API code are only slightly different, the sample uses:

        SetExpressCheckoutRequestType request = new SetExpressCheckoutRequestType();
        populateRequestObject(request); //populate request data
        SetExpressCheckoutReq wrapper = new SetExpressCheckoutReq();
        wrapper.SetExpressCheckoutRequest = request;
        Dictionary<string, string> configurationMap = Configuration.GetAcctAndConfig(); //set merchant config
        PayPalAPIInterfaceServiceService service = new PayPalAPIInterfaceServiceService(configurationMap);
        SetExpressCheckoutResponseType setECResponse = service.SetExpressCheckout(wrapper); //make the call

Where my (again, very old code looks like this):

    CallerServices caller = new CallerServices();
    caller.APIProfile = SetProfile.ApplicationProfile; //set merchant config
    SetExpressCheckoutRequestType pp_request = new SetExpressCheckoutRequestType();
    // Create the request details object
    pp_request.SetExpressCheckoutRequestDetails = new SetExpressCheckoutRequestDetailsType();
    pp_request.SetExpressCheckoutRequestDetails.PaymentAction = paymentAction;
    pp_request.SetExpressCheckoutRequestDetails.PaymentActionSpecified = true;

    pp_request.SetExpressCheckoutRequestDetails.OrderTotal = new BasicAmountType();

    pp_request.SetExpressCheckoutRequestDetails.OrderTotal.currencyID = currencyCodeType;
    pp_request.SetExpressCheckoutRequestDetails.OrderTotal.Value = paymentAmount;

    pp_request.SetExpressCheckoutRequestDetails.CancelURL = cancelURL;
    pp_request.SetExpressCheckoutRequestDetails.ReturnURL = returnURL;
    return (SetExpressCheckoutResponseType) caller.Call("SetExpressCheckout", pp_request); //do the call

The sample code works, my code throws the SSL/TLS error. I tried upgrading to the latest SDK, but so much has changed, it will be quite a large effort to migrate all that code.

From fiddler, it seems to be using TLS 1.2 even with the old API, but I get a runtime exception about the SSL/TLS connection. Is it because of the different endpoint? Is the old API just too old?

Thanks in advance for any help - I would love to avoid migrating all that ancient code!.

EDIT: I should mention I am using the UserName/Password/Signature credentials, not certificate based credentials.

Hey Jeff...I just inherited old WebForms code that has this exact same concern. Wondering if you ever got an answer to this? — user1011627
Sorry, I think I forgot to come back here to accept the answer, but PP_MTS_hzhu is correct. I upgraded the assembly to 4.5 and then added the line of code in the answer to a static constructor and it worked. I did not need to use a new PayPal API. — Jeff Anderson

PP_MTS_hzhu PP_MTS_hzhu · Accepted Answer · 2016-09-29T09:11:01

As TLS1.2 is supported in .Net4.5 but it is not a default protocol. you need to opt-in to use it. The following code will make TLS 1.2 default, make sure to execute it before making a connection to secured resource:

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12

Do I need a new PayPal API to support TLS 1.2 on .Net server?

2 Answers