RE: [PHP-DEV] Re: Re: PHP Crypt functions - security audit
| From: | Bryan C. Geraghty | Date: | Thu, 19 Sep 2013 13:29:35 +0000 |
| Subject: | RE: [PHP-DEV] Re: Re: PHP Crypt functions - security audit | ||
| References: | 1 2 3 4 5 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-69232@lists.php.net to get a copy of this message | ||
-----Original Message-----
From: tjerk.meesters@gmail.com [mailto:tjerk.meesters@gmail.com] On Behalf
Of Tjerk Anne Meesters
Sent: Thursday, September 19, 2013 4:01 AM
> My point is that you need a reasonably up-to-date certs bundle to enable
verification by default.
Actually, you don't. There is no reason why certificate validation cannot be
enabled by default without a CA bundle. Yes, verifications will fail by
default but this is no different than the cases where someone has an oddball
provider or self-signed certificates; they have to manually add the cert for
verification to pass.
Additionally, given the current certificate climate, I wouldn't trust
anything signed by the global CAs. If you're concerned about security, you
should be validating the certificate fingerprint and not trusting CAs.
Bryan