Re: [PEAR-DEV] HTTP_Request2 SSL/TLS issue (was Re: Can I (or Alexey) do a release of HTTP_Request2?)

On 2/7/2016 7:29 PM, Alexey Borzov wrote:
> Hi Michael,
>
> On 08.02.2016 1:14, Michael Gauthier wrote:
>>> I still need to address
>>> http://pear.php.net/bugs/bug.php?id=20462 which can lead to selecting
>>> less-secure SSL versions.
>>>
>> Can I help out with this? I have access to an old (Snow Leopard) and a
>> new OS X
>> (El Capitan) machine. Is the current issue just that you are unable to
>> reproduce
>> the issue or do you already have an API update in mind?
>>
>> Let me know if I can help.
>
> Well, it would be nice to know whether the report is reproducible. If
> you can check on several OS X versions then please do this.
>
> And yes, I have some code changes planned, one was mentioned in the next
> to last comment in #20462: getting rid of insecure SSL versions in
> HTTP_Request2_SocketWrapper::enableCrypto().
>
> It may also make sense to use some newer knobs if we are running on PHP
> 5.4+ and/or PHP 5.6+ and to make changes outlined at
> http://phpsecurity.readthedocs.org/en/latest/Transport-Layer-Security-(HTTPS-SSL-and-TLS).html
>
That's a great article. So for the next release the outstanding SSL/TLS 
features are:

  * disable insecure SSL versions by default
  * in supported PHP/OpenSSL versions, set more secure SSL context 
options by default

Should we also distribute the ca bundle so peer verification works by 
default?

Cheers,
Mike