Django集成PayPal的TSL 1.2及HTTPS配置问题咨询

Hey there! Let's work through troubleshooting your PayPal integration issue with Django—since you already have SSL set up via django-sslserver but still can't connect, TLS 1.2 support is almost certainly the missing piece here. Here's a step-by-step breakdown of what to check:

1. 强制django-sslserver使用TLS 1.2+ #

django-sslserver's default configuration might not enforce a minimum TLS version, and PayPal now requires at least TLS 1.2. You can fix this either temporarily via command line or permanently in your settings:

• Run the server with a specific protocol flag:

  python manage.py runsslserver --ssl-protocol TLSv1_2
  

• Or add persistent config to your settings.py (don't forget to import the ssl module first):

  import ssl
  
  SSL_SERVER_OPTIONS = {
      'ssl_version': ssl.PROTOCOL_TLSv1_2,
  }
  

2. Verify your Python/OpenSSL environment #

PayPal's TLS 1.2 requirements mandate Python 2.7.9+/3.4+ and OpenSSL 1.0.1c or newer. Check your versions with these commands:

• Check Python version: python --version
• Check OpenSSL version:

  python -c "import ssl; print(ssl.OPENSSL_VERSION)"
  

If either version is too low, upgrade them—this is a critical foundational requirement.

3. Test your server's TLS compatibility directly #

Use OpenSSL to confirm your Django server actually accepts TLS 1.2 connections:

openssl s_client -connect your-domain:your-port -tls1_2

A successful connection will show certificate details and handshake confirmation. If you get a "handshake failure" error, your server's TLS config is still misconfigured.

4. Ensure PayPal API calls use TLS 1.2 #

If you're using a library like requests to call PayPal's API, you need to force it to use TLS 1.2 (some systems default to older versions). Create a custom adapter and mount it to your session:

import requests
from requests.adapters import HTTPAdapter
from urllib3.poolmanager import PoolManager
import ssl

class TLS12Adapter(HTTPAdapter):
    def init_poolmanager(self, connections, maxsize, block=False):
        self.poolmanager = PoolManager(
            num_pools=connections,
            maxsize=maxsize,
            block=block,
            ssl_version=ssl.PROTOCOL_TLSv1_2
        )

# Apply the adapter to PayPal API domains
session = requests.Session()
# For production
session.mount('https://api.paypal.com/', TLS12Adapter())
# For sandbox testing
session.mount('https://api.sandbox.paypal.com/', TLS12Adapter())

# Use this session for all PayPal API requests
response = session.post(your_paypal_api_endpoint, json=your_payload)

5. Check Django's security settings #

Make sure your settings.py doesn't have config that interferes with TLS:

• Confirm SECURE_SSL_REDIRECT is set appropriately (True for production, adjust for testing)
• If using a reverse proxy, verify SECURE_PROXY_SSL_HEADER is configured correctly (e.g., SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https'))
• Set SESSION_COOKIE_SECURE and CSRF_COOKIE_SECURE to True—this is HTTPS best practice and can affect PayPal's callback validation.

6. Review PayPal's error details #

PayPal almost always returns specific error messages, either in API responses or webhook callbacks. Check your Django logs for messages like "TLS version not supported"—this will directly confirm if TLS is the issue.

内容的提问来源于stack exchange，提问作者user8755781