Re: Changing the default value of "true" for CURLOPT_SSL_VERIFYHOST
| From: | JJ | Date: | Thu, 25 Oct 2012 05:46:57 +0000 |
| Subject: | Re: Changing the default value of "true" for CURLOPT_SSL_VERIFYHOST | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-63611@lists.php.net to get a copy of this message | ||
On Wed, Oct 24, 2012 at 10:34 PM, Sherif Ramadan
<theanomaly.is@gmail.com> wrote:
> I understand there are people out there that don't read the
> documentation and aren't aware of the difference between
> curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2); and curl_setopt($ch,
> CURLOPT_SSL_VERIFYHOST, true); but still... I don't think this is a
> good idea either.
I highly doubt code that sets CURLOPT_SSL_VERIFYHOST => true meant to
imply CURLOPT_SSL_VERIFYHOST => 1...which essentially bypasses host
verification.
According to libcurl, CURLOPT_SSL_VERIFYHOST => 1 is "not ordinarily a
useful setting".
- JJ