Paypal Sandbox TLS update (400) Bad Request
<p>Paypal sandbox has been updated to use TLS 1.2 (<a href="https://devblog.paypal.com/upcoming-security-changes-notice/#tls" rel="nofollow">https://devblog.paypal.com/upcoming-security-changes-notice/#tls</a>). Without any changes at my end, I was seeing 'handshake_failure' error.</p>

<p>I've updated the JAVA library that we use as suggested in <a href="https://github.com/paypal/TLS-update#paypal-java-sdk-support" rel="nofollow">https://github.com/paypal/TLS-update#paypal-java-sdk-support</a>. I use the legacy 1.x version.</p>

<p>However, PayPal throws PayPalException.</p>

<pre><code>[com.paypal.sdk.exceptions.TransactionException] (http-localhost/127.0.0.1:8082-7) (400)Bad Request:
</code></pre>

<p>In addition to updating paypal_base.jar (soap), I also use VM option "-Dhttps.protocols=TLSv1.1,TLSv1.2" but it does not make any difference.</p>

<p>The paypal endpoint I am using is </p>

<pre><code>https://www.sandbox.paypal.com/cgi-bin/webscr?cmd=_express-checkout&amp;useraction=commit&amp;token=
</code></pre>

<p>I have tried using the endpoint API Signature -> SOAP -> Sandbox as provided in <a href="https://developer.paypal.com/docs/classic/api/endpoints/" rel="nofollow">https://developer.paypal.com/docs/classic/api/endpoints/</a> but with no success.</p>

<p>Any suggestions on what else needs to happen?</p>

<p><strong>UPDATE</strong></p>

<p>I ran the test application they've provided (TlsCheck.java / jar) and below is the result</p>

<pre><code>java "-Dhttps.protocols=TLSv1.1,TLSv1.2" -jar TlsCheck.jar 
this client supports TLS 1.2
Failed to connect to TLS 1.2 endpoint
</code></pre>

<p>Accessing the endpoint tlstest.paypal.com in the browser returns a '400 Bad Request'. Changing the end point to <a href="https://tlstest.paypal.com" rel="nofollow">https://tlstest.paypal.com</a> returns "PayPal_Connection_OK" as expected.</p>

<p>I also made a copy of TlsCheck.java (using its default endpoint tlstest.paypal.com) and ran it via my IDE which returned the following (although it was failing to connect initially)</p>

<pre><code>this client supports TLS 1.2
Successfully connected to TLS 1.2 endpoint
</code></pre>

<p>Tried the same with other endpoints like "api-3t.sandbox.paypal.com/2.0/" but it fails to connect to it stating</p>

<pre><code>Failed to connect to TLS 1.2 endpoint
</code></pre>

<p><strong>Update</strong></p>

<p>Turns out my the test using TslCheck.jar failed because the endpoint used in the JAR was "tlscheck.chargify.com" (invalid??) but the source code (from the same location <a href="https://github.com/paypal/TLS-update/tree/master/java" rel="nofollow">https://github.com/paypal/TLS-update/tree/master/java</a>) used a different endpoint "tlstest.paypal.com" (valid).</p>

<p><strong>Update</strong></p>

<p>Despite updating paypal_base.jar I am currently seeing "No service named PayPalAPIAA is available" which eventually leads to 404 Bad Request. Also confirmed that I am using HTTP/1.0 as HTTPSender in the axis library we use defaults to HTTP/1.1. I haven't found a proper way to get around it. I tried following <a href="https://www-10.lotus.com/ldd/pfwiki.nsf/dx/10022008035400PMWEBRCB.htm" rel="nofollow">https://www-10.lotus.com/ldd/pfwiki.nsf/dx/10022008035400PMWEBRCB.htm</a> to switch to HTTP/1.1. This did not work in my case!!!!</p>