Re: [PEAR-DEV] HTTP_Request2 SSL/TLS issue (was Re: Can I (or Alexey) do a release of HTTP_Request2?)

Hi Michael,

On 08.02.2016 18:40, Michael Gauthier wrote:
>> Well, it would be nice to know whether the report is reproducible. If
>> you can check on several OS X versions then please do this.

Thanks for your testing of bug #20462

Looks like there was something fishy with the original report and/or with a 
particular PHP installation the reporter used.

>>
>> And yes, I have some code changes planned, one was mentioned in the next
>> to last comment in #20462: getting rid of insecure SSL versions in
>> HTTP_Request2_SocketWrapper::enableCrypto().
>>
>> It may also make sense to use some newer knobs if we are running on PHP
>> 5.4+ and/or PHP 5.6+ and to make changes outlined at
>> http://phpsecurity.readthedocs.org/en/latest/Transport-Layer-Security-(HTTPS-SSL-and-TLS).html
>>
>>
> That's a great article. So for the next release the outstanding SSL/TLS features
> are:
>
>   * disable insecure SSL versions by default
>   * in supported PHP/OpenSSL versions, set more secure SSL context options by
> default

Yes. I'll make a few more tests on whether it is possible to force using TLS 
above version 1.0 in PHP below version 5.6 but right now that doesn't seem to be 
the case...

Maybe it is a good idea then to explicitly connect to tls:// instead of ssl:// 
anyway since this will at least prevent falling back to SSL v3.


> Should we also distribute the ca bundle so peer verification works by default?

I'd prefer not to, using system-wide bundle is a more robust solution.

Need of CA files and possible ways to set them up are already documented:
http://pear.php.net/manual/en/package.http.http-request2.config.php#package.http.http-request2.config.ssl