Answers.Body: <p><strong>No, PayPal state that SSL will not required for IPN.</strong> I contacted PayPal MTS to confirm and got the responses below:</p>
  
  <p><a href="https://i.sstatic.net/hljhF.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/hljhF.png" alt="email reply from paypal MTS"></a></p>
  
  <p><a href="https://i.sstatic.net/mjEbA.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/mjEbA.png" alt="forum reply from paypal_frank"></a></p>
  
  <hr>
  
  <p>PayPal seem to be saying</p>
  
  <ul>
  <li><strong>if you have SSL yourself</strong>, your certificate and its chain need SHA-256 not SHA-1 both for PayPal and <a href="http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html" rel="nofollow noreferrer">modern browser support</a>,</li>
  <li><strong>when you connect to their server</strong>, your webserver must accommodate <em>their</em> SHA-256 certificate. Most hosting environments will be fine, but older envs lacking SHA-256 support in SSL libs won't.</li>
  </ul>
  
  <p>PayPals docs are a bit unclear (hence your question!), but they seem to be stating <em>certificates must be SHA-256</em> rather than <em>all sites require a certificate</em>. In particular the graphic at top of <a href="https://www.paypal-knowledge.com/infocenter/index?page=content&amp;id=FAQ1766&amp;expand=true&amp;locale=en_US#FAQs" rel="nofollow noreferrer">2015-2016 SSL Cert Change Microsite</a>) can confuse since it says "must be running a SHA-256 compliant server".</p>
  
  <p><a href="https://i.sstatic.net/04ztr.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/04ztr.jpg" alt="PayPal IPN microsite banner"></a></p>
  
  <p>My assessment, based on the following (later confirmed via PayPal MTS), is that non-SSL IPN will still be supported. Rationale:</p>
  
  <ul>
  <li>Requiring SSL for all sites would be a <strong>big business change</strong>; it would kill IPN on a lot of small orgs who don't have the $$ for SSL hosting.</li>
  <li>PayPal's <strong><a href="https://developer.paypal.com/developer/ipnSimulator/" rel="nofollow noreferrer">IPN simulator</a> does not validate the protocol</strong> for SSL. If this was a requirement, they would implement it in their simulator.</li>
  <li>PayPal's <strong>IPN simulator works using plain HTTP</strong>, fails when using SSL to a SHA-1 cert site, and works when using SSL to a SHA-256 cert site.</li>
  <li>PayPal's docs <strong>refer to "SHA-256 compliance"</strong> and seem to say "require SHA-256 compliant cert" rather than "require a cert".</li>
  </ul>
  
  <p>I've submitted a support question &amp; asked PayPal on Twitter (<a href="https://twitter.com/xurizaemon/status/642466912979447808" rel="nofollow noreferrer">1</a>, <a href="https://twitter.com/DeveloperSteve/status/643185498115059712" rel="nofollow noreferrer">2</a>). Will update if we get a canonical YES or NO - we have multiple clients asking the same.</p>
  
  <p>Update: Initial responses (reply from MTS, Twitter) are that <a href="https://twitter.com/xurizaemon/status/643266059798118400" rel="nofollow noreferrer">HTTP IPN will be a supported use case after SHA256 rollout</a>.</p>
  
  <p>Update 2: PayPal Merchant Technical Services have replied that <em>IPN over plain HTTP can be supported once 2015-2016 SSL migration completes.</em> Answer updated.</p>
  
  <p>Update 3: Adding confirmation from @PayPal_Frank in <a href="https://www.paypal-community.com/t5/About-Business/PayPal-Endpoint-certificate-upgrade-SHA-256-encryption/m-p/997945/highlight/true#M17399" rel="nofollow noreferrer">a paypal-community.com forum question</a></p>
  
  <hr>
  
  <p>All that said - I recommend that ALL organisations using CiviCRM should SSL their traffic for contact privacy. Read <a href="https://civicrm.org/blogs/joe-murray/reset-net-civicrm" rel="nofollow noreferrer">Joe Murray's post on the CiviCRM blog</a> and consider your contact's privacy - SSL is inexpensive and helps build trust; it'll probably pay off for your org.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-11T22:12:55.033Z
Answers.Text: Chris, PayPal sent out a notice today to clients who specifically use the IPN functionality which is for completed transaction information being sent from PP to the clients webserver.  This secure connection will need to use SHA-256 or PP will abort the transmission.
Answers.UserDisplayName: DaveD
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-11T22:29:38.363Z
Answers.Text: Thanks Dave. That does make sense - perhaps IPN is supported over plain HTTP, but not over less-secure HTTPs configs for sites which do use SSL. I don't see any specific mention that IPN requires SSL on [PayPal's integration guide](https://developer.paypal.com/docs/classic/ipn/integration-guide/IPNSetup/), but docs can be wrong. Also, [related discussion on wordpress.org](https://wordpress.org/support/topic/paypal-ipn-fails-with-https-ssl-here-are-causes).
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-11T22:34:28.893Z
Answers.Text: Also, as Dave suggests: **SSL all the things**, it's just good sense. CiviCRM contacts deserve privacy, and not just for transaction data. IMO using CiviCRM without SSL is playing fast and lose with privacy.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-13T22:29:24.467Z
Answers.Text: I've updated this answer from my original reply.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-14T08:04:46.770Z
Answers.Text: Got a firm reply from PayPal MTS, answer updated above.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-11T22:00:32.923Z
Answers.LastActivityDate: 2015-09-14T21:07:37.630Z
Answers.LastEditDate: 2015-09-14T21:07:37.630Z
Answers.UserDisplayName: Chris Burgess
Answers.Body: <p>You probably need to pose this question directly to PayPal. It's really a matter of whether they will require a secure connection going forward. It could be that they will force it.</p>
  
  <p>It also may depend upon your host.  One client of mine is hosted on HostGator and they too do not have an SSL cert, however in its absence the HostGator SSL cert takes over (and it has SHA-256 encryption). The best way to check this is to go to your site using HTTPS and see if a cert is presented, and if so, you can see whose cert it is and if it has the proper encryption.</p>
  
  <p>As you said it is advisable to have an SSL, and these days, it really is a no-brainer that you should have one.  The price for a basic cert is dirt cheap; I usually can get one for $30/yr. Highly recommended.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-11T22:37:38.390Z
Answers.Text: Asked @AskPayPal: https://twitter.com/xurizaemon/status/642466912979447808
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-11T22:47:54.683Z
Answers.Text: [the image](https://www.paypal-knowledge.com/library/PAYPAL/TECHNICAL_SUPPORT/FAQ1766/banner_ipn.jpg) at the top of [their SSL cert microsite](https://www.paypal-knowledge.com/infocenter/index?page=content&id=FAQ1766&expand=true&locale=en_US#FAQs) does seem to say you'll need SSL for IPN now.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-14T16:53:47.053Z
Answers.Text: PayPal's communication concerns the **client SSL/TLS** connection back to www.paypal.com (for the IPN message validation). There will be **no** impact on IPN message **delivery** to merchant servers and/or CivicCRM installations.
Answers.UserDisplayName: Robert
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-16T00:33:29.777Z
Answers.Text: @Robert, please refer to my answer (or  [Twitter conver](https://twitter.com/xurizaemon/status/643184753546391554)), as there *is* impact (confirmed by PayPal reps) if you are using IPN to merchant server and the merchant server uses SSL with SHA-1 cert.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-11T21:38:55.903Z
Answers.LastActivityDate: 2015-09-11T21:38:55.903Z
Answers.UserDisplayName: DaveD
Body: <p>PayPal is upgrading their certificate and require that people's certificates are also upgraded. Copying the notice below.</p>
  
  <p>But IPN can currently be used without a certificate. Does anyone know if that will not be allowed in future? Or if the older certificates will not work but non-ssl connections will continue to work? </p>
  
  <p>I know it's advisable to have SSL... But some sites want to avoid having SSL and that's why they use PayPal, to avoid asking for credit card information on their site.</p>
  
  <p>PayPal email:</p>
  
  <blockquote>
    <p>As we have previously communicated to you, PayPal is upgrading the certificate for www.paypal.com to SHA-256. This endpoint is also used by merchants using the Instant Payment Notification (IPN) product.</p>
    
    <p>This upgrade is scheduled for 9/30/2015; however, we may need to change this date on short notice to you to align to the industry security standard.</p>
    
    <p>You’re receiving this notification because you’ve been identified as a merchant who has used IPN endpoints within the past year. If you have not made the necessary changes, we urge you to do so right away to avoid a disruption of your service!</p>
  </blockquote>
  
  <p><a href="https://www.paypal-community.com/t5/About-Business/PayPal-Endpoint-certificate-upgrade-SHA-256-encryption/m-p/997455#U997455">https://www.paypal-community.com/t5/About-Business/PayPal-Endpoint-certificate-upgrade-SHA-256-encryption/m-p/997455#U997455</a></p>
  
  <blockquote>
    <p>Merchants using PayPal Instant Payment Notifications (IPN) may be impacted by the change if their web server is not enabled for SHA-256 compliance. If you are using a 3rd party solution for order management and for integrating PayPal on your website, you may be using IPN.  Please check with your shopping cart provider to see if you are affected.</p>
  </blockquote>
  
  <p>and</p>
  
  <blockquote>
    <p>If you are a merchant who uses IPN with PayPal, your server will need to be upgraded to support SHA-256.  Please contact your web host or the checkout partner providing the integration solution to ensure SHA-256 is enabled for the server.</p>
  </blockquote>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-09-11T22:44:08.253Z
Comments.Text: Added some additional quotes from PayPal docs. If PayPal are not permitting IPN over HTTP, they should reject attempts to set HTTP IPN URLs - so you may be able to confirm that in your PayPal account settings? The above excerpts do seem to suggest HTTP IPN is not supported, but I'd be surprised if that was the case; it'd be a big change ...
Comments.UserDisplayName: Chris Burgess
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-09-12T03:10:41.010Z
Comments.Text: https://developer.paypal.com/developer/ipnSimulator/ currently permits IPN over HTTP as well as HTTPs.
Comments.UserDisplayName: Chris Burgess
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-09-24T15:32:38.840Z
Comments.Text: I have make some test on the IPN at this link: https://developer.paypal.com/developer/ipnSimulator/ The result was: "IPN was sent and the handshake was verified." I am ok with my IPN, for SHA - 256 update ?
Comments.UserDisplayName: edgar
Tags: <payment-processor><paypal>
Title: Do sites without SSL now need one for PayPal IPN?
ThreadText: # Do sites without SSL now need one for PayPal IPN?
  
  (Asked by: username_0 on 2015-09-11)
  
  PayPal is upgrading their certificate and require that people's certificates are also upgraded. Copying the notice below.
  
  But IPN can currently be used without a certificate. Does anyone know if that will not be allowed in future? Or if the older certificates will not work but non-ssl connections will continue to work?
  
  I know it's advisable to have SSL... But some sites want to avoid having SSL and that's why they use PayPal, to avoid asking for credit card information on their site.
  
  PayPal email:
  
  > As we have previously communicated to you, PayPal is upgrading the certificate for www.paypal.com to SHA-256. This endpoint is also used by merchants using the Instant Payment Notification (IPN) product.
  >
  > This upgrade is scheduled for 9/30/2015; however, we may need to change this date on short notice to you to align to the industry security standard.
  >
  > You’re receiving this notification because you’ve been identified as a merchant who has used IPN endpoints within the past year. If you have not made the necessary changes, we urge you to do so right away to avoid a disruption of your service!
  
  <https://www.paypal-community.com/t5/About-Business/PayPal-Endpoint-certificate-upgrade-SHA-256-encryption/m-p/997455#U997455>
  
  > Merchants using PayPal Instant Payment Notifications (IPN) may be impacted by the change if their web server is not enabled for SHA-256 compliance. If you are using a 3rd party solution for order management and for integrating PayPal on your website, you may be using IPN. Please check with your shopping cart provider to see if you are affected.
  
  and
  
  > If you are a merchant who uses IPN with PayPal, your server will need to be upgraded to support SHA-256. Please contact your web host or the checkout partner providing the integration solution to ensure SHA-256 is enabled for the server.
  
  **Tags:** payment-processor, paypal
  
  > **Comments:**
  > **username_1**: Added some additional quotes from PayPal docs. If PayPal are not permitting IPN over HTTP, they should reject attempts to set HTTP IPN URLs - so you may be able to confirm that in your PayPal account settings? The above excerpts do seem to suggest HTTP IPN is not supported, but I'd be surprised if that was the case; it'd be a big change ...  
  > **username_1**: https://developer.paypal.com/developer/ipnSimulator/ currently permits IPN over HTTP as well as HTTPs.  
  > **username_2**: I have make some test on the IPN at this link: https://developer.paypal.com/developer/ipnSimulator/ The result was: "IPN was sent and the handshake was verified." I am ok with my IPN, for SHA - 256 update ?  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2015-09-11. Score: 7 | Accepted answer
  
  **No, PayPal state that SSL will not required for IPN.** I contacted PayPal MTS to confirm and got the responses below:
  
  [![email reply from paypal MTS](https://i.sstatic.net/hljhF.png)](https://i.sstatic.net/hljhF.png)
  
  [![forum reply from paypal_frank](https://i.sstatic.net/mjEbA.png)](https://i.sstatic.net/mjEbA.png)
  
  ---
  
  PayPal seem to be saying
  
  * **if you have SSL yourself**, your certificate and its chain need SHA-256 not SHA-1 both for PayPal and [modern browser support](http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html),
  * **when you connect to their server**, your webserver must accommodate *their* SHA-256 certificate. Most hosting environments will be fine, but older envs lacking SHA-256 support in SSL libs won't.
  
  PayPals docs are a bit unclear (hence your question!), but they seem to be stating *certificates must be SHA-256* rather than *all sites require a certificate*. In particular the graphic at top of [2015-2016 SSL Cert Change Microsite](https://www.paypal-knowledge.com/infocenter/index?page=content&id=FAQ1766&expand=true&locale=en_US#FAQs)) can confuse since it says "must be running a SHA-256 compliant server".
  
  [![PayPal IPN microsite banner](https://i.sstatic.net/04ztr.jpg)](https://i.sstatic.net/04ztr.jpg)
  
  My assessment, based on the following (later confirmed via PayPal MTS), is that non-SSL IPN will still be supported. Rationale:
  
  * Requiring SSL for all sites would be a **big business change**; it would kill IPN on a lot of small orgs who don't have the $$ for SSL hosting.
  * PayPal's **[IPN simulator](https://developer.paypal.com/developer/ipnSimulator/) does not validate the protocol** for SSL. If this was a requirement, they would implement it in their simulator.
  * PayPal's **IPN simulator works using plain HTTP**, fails when using SSL to a SHA-1 cert site, and works when using SSL to a SHA-256 cert site.
  * PayPal's docs **refer to "SHA-256 compliance"** and seem to say "require SHA-256 compliant cert" rather than "require a cert".
  
  I've submitted a support question & asked PayPal on Twitter ([1](https://twitter.com/xurizaemon/status/642466912979447808), [2](https://twitter.com/DeveloperSteve/status/643185498115059712)). Will update if we get a canonical YES or NO - we have multiple clients asking the same.
  
  Update: Initial responses (reply from MTS, Twitter) are that [HTTP IPN will be a supported use case after SHA256 rollout](https://twitter.com/xurizaemon/status/643266059798118400).
  
  Update 2: PayPal Merchant Technical Services have replied that *IPN over plain HTTP can be supported once 2015-2016 SSL migration completes.* Answer updated.
  
  Update 3: Adding confirmation from @PayPal\_Frank in [a paypal-community.com forum question](https://www.paypal-community.com/t5/About-Business/PayPal-Endpoint-certificate-upgrade-SHA-256-encryption/m-p/997945/highlight/true#M17399)
  
  ---
  
  All that said - I recommend that ALL organisations using CiviCRM should SSL their traffic for contact privacy. Read [Joe Murray's post on the CiviCRM blog](https://civicrm.org/blogs/joe-murray/reset-net-civicrm) and consider your contact's privacy - SSL is inexpensive and helps build trust; it'll probably pay off for your org.
  
  > **Comments:**
  > **username_3**: Chris, PayPal sent out a notice today to clients who specifically use the IPN functionality which is for completed transaction information being sent from PP to the clients webserver.  This secure connection will need to use SHA-256 or PP will abort the transmission.  
  > **username_1**: Thanks Dave. That does make sense - perhaps IPN is supported over plain HTTP, but not over less-secure HTTPs configs for sites which do use SSL. I don't see any specific mention that IPN requires SSL on [PayPal's integration guide](https://developer.paypal.com/docs/classic/ipn/integration-guide/IPNSetup/), but docs can be wrong. Also, [related discussion on wordpress.org](https://wordpress.org/support/topic/paypal-ipn-fails-with-https-ssl-here-are-causes).  
  > **username_1**: Also, as Dave suggests: **SSL all the things**, it's just good sense. CiviCRM contacts deserve privacy, and not just for transaction data. IMO using CiviCRM without SSL is playing fast and lose with privacy.  
  > **username_1**: I've updated this answer from my original reply.  
  > **username_1**: Got a firm reply from PayPal MTS, answer updated above.  
  
  ---
  
  ### Answer by username_3 on 2015-09-11. Score: 1
  
  You probably need to pose this question directly to PayPal. It's really a matter of whether they will require a secure connection going forward. It could be that they will force it.
  
  It also may depend upon your host. One client of mine is hosted on HostGator and they too do not have an SSL cert, however in its absence the HostGator SSL cert takes over (and it has SHA-256 encryption). The best way to check this is to go to your site using HTTPS and see if a cert is presented, and if so, you can see whose cert it is and if it has the proper encryption.
  
  As you said it is advisable to have an SSL, and these days, it really is a no-brainer that you should have one. The price for a basic cert is dirt cheap; I usually can get one for $30/yr. Highly recommended.
  
  > **Comments:**
  > **username_1**: Asked @AskPayPal: https://twitter.com/xurizaemon/status/642466912979447808  
  > **username_1**: [the image](https://www.paypal-knowledge.com/library/PAYPAL/TECHNICAL_SUPPORT/FAQ1766/banner_ipn.jpg) at the top of [their SSL cert microsite](https://www.paypal-knowledge.com/infocenter/index?page=content&id=FAQ1766&expand=true&locale=en_US#FAQs) does seem to say you'll need SSL for IPN now.  
  > **username_4**: PayPal's communication concerns the **client SSL/TLS** connection back to www.paypal.com (for the IPN message validation). There will be **no** impact on IPN message **delivery** to merchant servers and/or CivicCRM installations.  
  > **username_1**: @username_4, please refer to my answer (or  [Twitter conver](https://twitter.com/xurizaemon/status/643184753546391554)), as there *is* impact (confirmed by PayPal reps) if you are using IPN to merchant server and the merchant server uses SSL with SHA-1 cert.  
  
  ---
  
  