[php-src] Issue #13328: support for FastCGI over TLS

From: Date: Mon, 05 Feb 2024 11:26:45 +0000
Subject: [php-src] Issue #13328: support for FastCGI over TLS
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-246407@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/13328
Author: ctr49

### Description

Currently, php-fpm supports UNIX and TCP socket operation. However, to enhance security (and privacy
of data in transit) it might be useful to also have an option for a TLS socket, ideally mTLS,
additional to TCP for remote connections.

In such cases, it is already possible to use transparent transport encryption (VPN, or a
TLS-tunnel), but php-fpm wouldn't have an idea about it. With integrated TLS support,
information from the TLS session (e.g. X.509 attributes) could be used to populate
"allowed_clients" or php-fpm's ENV to control further behavior.

Since (optional) OpenSSL support is already present in PHP, it should be relatively trivial to also
support a TLS listener - with a bit more work for mTLS and actually making use of TLS session
information.


Thread (1 message)

  • ctr49
« previous php.bugs (#246407) next »