Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
In particular, those four ciphersuites, with TLS 1.2, are the only ones offered by your server. Is it possible that someone told you that your server had to support TLS 1.2 only (because of financial industry rules or something) and you then removed a whole lot of cipher options?
It's possible to support a much wider range of ciphersuite options than this in TLS 1.2, and it could be that a client will be more willing or able to negotiate a TLS connection given some other cipher choices.
I haven't worked with Paypal in years but I recall the following:
PayPal has strict and often changing requirements on SSL.
1A- Every 2-3 years they update the required/supported protocols
1B- Ever 2-3 years they change their own trust anchors. You need to ensure their current trust anchor is in your server's trust store. IIRC, in the past few years it went from Verisign G2 to G5 and is now Digicert. If your server doesn't trust that cert, things break.
Their documentation changes often. They used to offer a downloadable PDF of the current developer guidelines. If they still do, it was updated twice a year and is the authoritative source on the current standards. Their online docs and articles are a mess, as are their official posts on third party websites. You're often reading outdated information.
The easiest way to address any of these things is to setup a PayPal sandbox account and test that against a test server you set up. That will let you trigger the notifications or mimic transactions on demand. Their sandbox is usually less than a year different from their production environment. Sometimes it's the same!
For what it's worth, I recommend the following free tool (in best practises mode) for a workable IIS server TLS config: Nartac Software - IIS Crypto - it will configure the appropriate registry keys and tighten up enabled TLS ciphers etc without making the server unusable.
