Sec Bug->Doc #53471 [Opn]: accepting self signed certs regarless of Stream Context

Edit report at http://bugs.php.net/bug.php?id=53471&edit=1 ID: 53471 Updated by: cataphract@php.net Reported by: f at case dot edu Summary: accepting self signed certs regarless of Stream Context Status: Open -Type: Security +Type: Documentation Problem Package: OpenSSL related Operating System: Windows PHP Version: 5.3.1RC2 Block user comment: N Private report: Y New Comment: You also need "verify_peer". The manual should be clearer on this. Previous Comments: ------------------------------------------------------------------------ [2010-12-04 04:05:39] f at case dot edu Description: ------------ self signed certificates seem to be accepted when using the protocol wrappers regardless of the allow_self_signed stream context the ftp package seems to reject self signed certificates however. Test script: --------------- $con=stream_context_create(array('ssl'=>array('allow_self_signed',false))); var_dump(file_get_contents('ftps://John:pass@selfsigned.example.com/test.php,false,$con')); $ftp=ftp_ssl_connect('selfsigned.example.com'); ftp_login($ftp,'John','pass'); Expected result: ---------------- file_get_contents and ftp_login should both throw some sort of error to the effect of "SSL/TLS handshake failed" Actual result: -------------- file_get_contents retrieves the file with no warnings ftp_login throws the error "SSL/TLS handshake failed" ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/bug.php?id=53471&edit=1