NETOPIA seals the IPN payload with the RC4 cipher (cipher => rc4 in the POST body). The decrypt path in Mobilpay/Payment/Request/Abstract.php passes 'rc4' straight to openssl_open() with no availability check.
PHP 8.3 links against OpenSSL 3.x, which moved RC4 into the legacy provider that is not loaded by default. With RC4 unavailable, openssl_open() returns false (it does not throw), landing on:
$result = @openssl_open($srcData, $data, $srcEnvKey, $privateKey, $cipher_algo, $srcIv);
...
if ($result === false) {
throw new Exception('Failed decrypting data', self::ERROR_CONFIRM_FAILED_DECRYPT_DATA);
}
The private key loads fine (execution gets past ERROR_CONFIRM_LOAD_PRIVATE_KEY), confirming this is a cipher problem, not a key problem. Note the encrypt path in the same class (encrypt()) already guards cipher availability and can fall back to AES — the decrypt path does not.
NETOPIA seals the IPN payload with the RC4 cipher (cipher => rc4 in the POST body). The decrypt path in Mobilpay/Payment/Request/Abstract.php passes 'rc4' straight to openssl_open() with no availability check.
PHP 8.3 links against OpenSSL 3.x, which moved RC4 into the legacy provider that is not loaded by default. With RC4 unavailable, openssl_open() returns false (it does not throw), landing on:
The private key loads fine (execution gets past ERROR_CONFIRM_LOAD_PRIVATE_KEY), confirming this is a cipher problem, not a key problem. Note the encrypt path in the same class (encrypt()) already guards cipher availability and can fall back to AES — the decrypt path does not.