title: WinHTTP.WinHTTPRequest.5.1 does not work with PayPal sandbox after TLS 1.2
body: <p>PayPal sandbox just recently restricted to TLS 1.2 connection.  This makes our site stop working with PayPal sandbox although it stills work with the production PayPal.  In the future the production PayPal will have the same restriction.  We're using classic ASP and Microsoft WinHTTP.WinHTTPRequest.5.1 component for communication with PayPal.  Here's the code below.  objHttp.StatusText returns "Bad Request".  We're on Windows Server 2008 R2.  I tried to use MSXML2.ServerXMLHTTP.6.0 instead, but it only works on my Windows 8.1 development machine, not on our Windows Server 2008 R2.  Although MSXML2.ServerXMLHTTP.6.0 is a superset of WinHTTP.WinHTTPRequest.5.1, but it is less reliable than WinHTTP.WinHTTPRequest.5.1.  Our code fails a few times a day using MSXML2.ServerXMLHTTP.6.0 in the past, so I prefer using WinHTTP.WinHTTPRequest.5.1.  I'm also not confident in this line of code: objHttp.Option(9) = &amp;H0AA0 .  A workaround that we're using is calling the WebAPI for sending message to PayPal; however, this causes an extra minor delay. </p>
  
  <pre><code>dim objHttp
  Set objHttp = Server.CreateObject("WinHTTP.WinHTTPRequest.5.1")
  dim WinHttpRequestOption_EnableHttp1_1 : WinHttpRequestOption_EnableHttp1_1 = 17
  objHttp.Option(WinHttpRequestOption_EnableHttp1_1) = False
  
  dim WinHttpRequestOption_SslErrorIgnoreFlags : WinHttpRequestOption_SslErrorIgnoreFlags=4
  objHttp.Option(WinHttpRequestOption_SslErrorIgnoreFlags) = &amp;H3300
  objHttp.setTimeouts 0, 120000, 120000, 120000 
  objHttp.Option(9) = &amp;H0AA0 '2720
  objHttp.open "post", "" &amp; "https://api-3t.sandbox.paypal.com/2.0/" &amp; "", False
  strRequest = SetExpressCheckoutSOAP(returnURL, cancelURL)
  objHttp.setRequestHeader "Content-Type", "text/xml; charset=utf-8"
  objHttp.setRequestHeader "Content-Length", Len(strRequest)
  
  objHttp.setRequestHeader "Host", "api-3t.sandbox.paypal.com"
  Call objHttp.send(strRequest)
  if objHttp.Status = 200 then
     resp = objHttp.responseText
  else
     response.write objHttp.StatusText
  end if
  </code></pre>
  
  <p>WebAPI invoke code:</p>
  
  <pre><code>dim webapiresp, webapidata
  webapidata = "{""url"":""" &amp; gv_APIEndpoint &amp; """, ""message"":""" &amp; nvpStrComplete &amp; """,""soap"":0}"
  webapiresp=InvokeWebAPI(strApiDomain, "POST", "comm/send", "", webapidata)
          set reply=JSON.parse(webapiresp)
          resp = reply.xml
  
  Function InvokeWebAPI(strApiDomain, method, funcname, param, data)
  dim HttpReq, apiURI, resp
  
  set HttpReq=Server.CreateObject("MSXML2.ServerXMLHTTP")
  'apiURI=strApiDomain &amp; funcname &amp; param
  apiURI=strApiDomain &amp; "api/" &amp; funcname &amp; param
  
  
  HttpReq.open method, apiURI, false
  
  HttpReq.setRequestHeader "Content-Type", "application/json; charset=UTF-8"
  HttpReq.setRequestHeader "SOAPAction", apiURI
  HttpReq.setRequestHeader "Authorization", "Basic " &amp; Base64Encode("xxx:xxx")
  
  if data &lt;&gt; "" then
      HttpReq.send data
  else
      HttpReq.send 
  end if
  
  resp = HttpReq.responseText
  
  set HttpReq=Nothing
  
  InvokeWebAPI = resp
  End Function
  </code></pre>