Do sites without SSL now need one for PayPal IPN?
No, PayPal state that SSL will not required for IPN. I contacted PayPal MTS to confirm and got the responses below:







PayPal seem to be saying


if you have SSL yourself, your certificate and its chain need SHA-256 not SHA-1 both for PayPal and modern browser support,
when you connect to their server, your webserver must accommodate their SHA-256 certificate. Most hosting environments will be fine, but older envs lacking SHA-256 support in SSL libs won't.


PayPals docs are a bit unclear (hence your question!), but they seem to be stating certificates must be SHA-256 rather than all sites require a certificate. In particular the graphic at top of 2015-2016 SSL Cert Change Microsite) can confuse since it says "must be running a SHA-256 compliant server".



My assessment, based on the following (later confirmed via PayPal MTS), is that non-SSL IPN will still be supported. Rationale:


Requiring SSL for all sites would be a big business change; it would kill IPN on a lot of small orgs who don't have the $$ for SSL hosting.
PayPal's IPN simulator does not validate the protocol for SSL. If this was a requirement, they would implement it in their simulator.
PayPal's IPN simulator works using plain HTTP, fails when using SSL to a SHA-1 cert site, and works when using SSL to a SHA-256 cert site.
PayPal's docs refer to "SHA-256 compliance" and seem to say "require SHA-256 compliant cert" rather than "require a cert".


I've submitted a support question &amp; asked PayPal on Twitter (1, 2). Will update if we get a canonical YES or NO - we have multiple clients asking the same.

Update: Initial responses (reply from MTS, Twitter) are that HTTP IPN will be a supported use case after SHA256 rollout.

Update 2: PayPal Merchant Technical Services have replied that IPN over plain HTTP can be supported once 2015-2016 SSL migration completes. Answer updated.

Update 3: Adding confirmation from @PayPal_Frank in a paypal-community.com forum question



All that said - I recommend that ALL organisations using CiviCRM should SSL their traffic for contact privacy. Read Joe Murray's post on the CiviCRM blog and consider your contact's privacy - SSL is inexpensive and helps build trust; it'll probably pay off for your org.