3 ms·
It by default doesn't try to verify the certificate of the peer it's connecting to? Isn't that the whole point of introducing TLS support? Pardon me if I'm mis
by thegeomaster 12y ago
It by default doesn't try to verify the certificate of the peer it's connecting to? Isn't that the whole point of introducing TLS support?
Pardon me if I'm missing something, but that sounds like a horrible design decision, and anyone who tries to use TLS streams without reading the documentation is fooled into a false sense of security.
- viraptor 12y agoYeah, I was surprised by that part until: "We must also specify the expected peer name on the presented certificate with the `CN_match` option, it will not be inferred from the URL and if it is not specified, the name on the certificate will not be validated." WTF? Who ever got the idea that this is something that can ever hit production?
- RobAley 12y agoAgain the article is out of date, it's now parsed from the URL if you don't specify a CN_match (which you can still do if you need to).
- DaveRandom 12y agoNot before 5.6 (where CN_match is actually deprecated in favour of peer_name)
- viraptor 12y agoThis doesn't matter now. People don't (and sometimes cannot) upgrade quickly. Also, documentation for the latest version still says peer_verify defaults to false and CN_match doesn't mention being computed automatically. Effectively if you write any code you're not going to deploy yourself, you have to specify the CN_match and verify_peer. Others will not know about the limitations, so this function is messed up until after 5.5 is EOLed. Designing APIs is hard and bad defaults can hurt for many major versions after they're changed.
- chc 12y agoIt is? Which of the versions of PHP linked from the homepage of PHP.net do this? I didn't think any of them did.
- RobAley 12y agoThe article is somewhat out of date, the default is now to verify (though you can turn it off if you need to). A lot is changing with PHP, and people aren't keeping up.
- johnnyfaehell 12y agoI love how this article was written today and is already out of date.
- DaveRandom 12y agoI did quite clearly state, this information applies to PHP versions before 5.6 (which means that in practice, people need to be doing this for at least the next two years until 5.6 is widely adopted)... The next article will cover the changes in 5.6 and why you don't need to set those ctx opts any more (and a few more you might want to set instead)
- viraptor 12y ago> the default is now to verify You mean in the version that's not properly released or anywhere close to production ready? 5.5 still defaults to not verifying according to the documentation.