PayPal IPN Integration – SSL Connection Reset By Peer

When integrating PayPal payment processing into a web application, one of the common errors is “SSL: Connection Reset By Peer.” This cryptic error message can be challenging to fix without the correct set of headers.

First a little background information about the role of PayPal IPN in the payment processing. The straightforward implementation of PayPal credit card processing is to add a button on the payment page that redirects to PayPal’s site for the payment processing. This helps alleviate security concerns by separating the site from the stringent PCI data security requirements. On successful completion of purchase, PayPal will redirect back to the originating site for the order receipt.

The challenge with this simpler implementation is that the source website has no confirmation that the product was actually purchased. While confirmation can be returned in post-back, the reality is that this can be spoofed by malicious clients.

PayPal’s solution to this dilemma is the introduction of the IPN utility. IPN stands for “Instant Payment Notification”, where the source website is notified in the back-end every time a payment is successfully processed. This way, the website receives a confirmation “behind the scenes”, and this confirmation cannot be spoofed due to the two-factor authentication.

The “SSL: Connection Reset By Peer” error occurs during the second part of the authentication. When the back-end page sends a direct request to PayPal to verify the validity of the order information, PayPal will ignore the request and send back this error message.

This error is due to unannounced changes in PayPal’s protocol – and even the examples in PayPal’s own documentation fail. The solution is to add two headers to the standard POST packet as follows:

$header = "POST /cgi-bin/webscr HTTP/1.1\r\n";
$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
$header .= "Content-Length: " . strlen($req) . "\r\n";
$header .= "Connection: Close\r\n";
$header .= "Host: www.paypal.com\r\n\r\n"; //use www.sandbox.paypal.com for test

If using the sandbox server, the final “host” line should list the sandbox SSL URL instead of the production PayPal URL. Also be sure to keep the correct alignment of line breaks – each header line should have one line break, except for the last line, which should have two line breaks.

This code will enable the HTTP 1.1 protocol on the POST packet, and make sure that the headers pass current PayPal verification standards.

Written by Andrew Palczewski

About the Author
Andrew Palczewski is CEO of apHarmony, a Chicago software development company. He holds a Master's degree in Computer Engineering from the University of Illinois at Urbana-Champaign and has over ten years' experience in managing development of software projects.
Google+