Comments on: CFX_PayFlowPro to stop working in 2009 – here’s a drop in replacement

By: Chuck

Chuck — Mon, 16 Aug 2010 15:12:39 +0000

to what?

By: Palawan Hotels

Palawan Hotels — Mon, 16 Aug 2010 14:57:13 +0000

I think you can change the url for the paypal

By: Melinda

Melinda — Fri, 30 Jul 2010 15:01:05 +0000

Chuck-
Not sure this will help, but when this happened to me it was related to changes made to our proxy server… the dns name did not work, but fixed by changing to proxy server ip.

By: Chuck

Chuck — Fri, 30 Jul 2010 14:56:05 +0000

thanks, yes nothing changed on our box except it just stopping processing.. could paypal changed their url?

By: ben

ben — Fri, 30 Jul 2010 14:49:30 +0000

here is one link of paypal helping my confused head:
https://www.x.com/message/164414#164414

here is the other link after I figured it out and posted the steps that worked for me:
https://www.x.com/message/175135#175135

I can't say if this will help with CF5, or if this is really your issue, but last time it "stopped" working .. this was the fix.

good luck.

By: ben

ben — Fri, 30 Jul 2010 14:41:33 +0000

Hi Chuck:

Have you updated the root certs? That fixed my problem the last time this tag, "stopped" working. The only time I've seen this tag stop working, is when paypal changes something without telling anyone (like the URL, or requiring the cert update)

Lemme see if I can't find my post with what I did to update certs.
also running IIS6

By: Chuck

Chuck — Fri, 30 Jul 2010 13:02:39 +0000

A couple of days ago our CF5 server stopped processing credit cards, is the paypal root cert update why? nothing has changed.. and if so what procedure do I use.. running IIS6.. Thanks

By: Eleni Hailu

Eleni Hailu — Fri, 18 Jun 2010 15:48:58 +0000

BradB: I had the same issue like you but after multiple call to paypal I managed to fix the problem. You need to update the certificate not only in the root but also inside the Coldfusion folder – YOU HAVE TO DO IT IN BOTH PLACES. Below is the information they provide in connection with this:

1. Download the certs from VeriSign at
https://www.verisign.com/support/roots.html

2. Open zip and location the Cert file that needs to be updated.
In this case the "VeriSign Class 3 – G2". Take note of it's location
on the server. Recommend renaming it to have no spaces and then
putting it in the "C:\CFusiomMX7\runtime\jre\lib\security" folder.

3. Open command prompt and type "cd c:\CFusionmx7\runtime\jre\bin"
or the location of the "keytool.exe" file and hit enter.
Don't try to run the keytool.exe without the next step. It won't
hurt anything, but it won't do anything either.

4. Now type the following replacing what it necessary
(such as the cert file name from step 2 above and alias name)

keytool -import -trustcacerts – keystore c:/cfusionmx7/runtime/jre/lib/security/cacerts -file c:/cfusionmx7/runtime/jre/lib/security/Class_3_Public_Primary_Certification_Authority_G2.cer -alias VeriSignG2

5. You'll be prompted for a password and as long as you haven't
ever changed it, it should be "changeit", which is the default.

6. You'll be prompted to approve the request. Type "yes"
without the quotes and hit enter

7. A bunch of text should appear validating the installation. If you
get an error, make sure your path and file names are correct in
the step above.

8. To verify, go to the jre\lib\security directory in Windows Explorer
and make sure the files modified date is today's date.

Hope this will help.

Thanks,

Eleni

By: BradB

BradB — Fri, 18 Jun 2010 15:00:21 +0000

Thanks Ryan and ben. It clearly seems to be related to the cert update, though so far the G2 update (I am also the host) does not seem to resolve the problem. The folks at Paypal seem to be willing to reluctanty admit an issue, but appear to have no method of resolution. It may be complicated by the fact that I buy my certs from Comodo and there are G2 root certs from different authorities (Verisign, Thawte, etc.) but Comodo does not seem to even understand what they are and I'm haing trouble getting a Comodo root kit that is compatible with the new Paypal system.

By: ben

ben — Thu, 17 Jun 2010 09:11:09 +0000

in response to BradB.

Paypal just updated their root SSL certificates a few days ago, and it screwed a lot of folks up. Ryan's tag still works fine, its just that your host may need to update their root certs and add them to the java keystore in cfmx7.
I had the same issue. it worked fine for years then it failed.

basically, until you update the certs on your machine with at least G2 certs from verisign, paypal won't answer a http request from coldfusion.

hope that helps