Re: [PEAR-DEV] HTTP_Request2 SSL/TLS issue (was Re: Can I (or Alexey) do a release of HTTP_Request2?)

Hi Michael,

On 08.02.2016 1:14, Michael Gauthier wrote:
>> I still need to address
>> http://pear.php.net/bugs/bug.php?id=20462 which can lead to selecting
>> less-secure SSL versions.
>>
> Can I help out with this? I have access to an old (Snow Leopard) and a new OS X
> (El Capitan) machine. Is the current issue just that you are unable to reproduce
> the issue or do you already have an API update in mind?
>
> Let me know if I can help.

Well, it would be nice to know whether the report is reproducible. If you can 
check on several OS X versions then please do this.

And yes, I have some code changes planned, one was mentioned in the next to last 
comment in #20462: getting rid of insecure SSL versions in 
HTTP_Request2_SocketWrapper::enableCrypto().

It may also make sense to use some newer knobs if we are running on PHP 5.4+ 
and/or PHP 5.6+ and to make changes outlined at
http://phpsecurity.readthedocs.org/en/latest/Transport-Layer-Security-(HTTPS-SSL-and-TLS).html