Re: [VOTE] Improved TLS Defaults RFC

On 12 February 2014 12:50, Daniel Lowrey <rdlowrey@gmail.com> wrote: > 1. Infinite descent is not an issue because, if unspecified, OpenSSL will > default to a verify depth of 9 as documented here: > > https://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html I would suggest that we set a default of 9 at the PHP level. I would prefer not to rely on OpenSSL always having a sane default. What with the docs (for OpenSSL) being updated so infrequently and people just generally configuring systems in idiotic ways it makes sense to me to accept OpenSSL's stated default value, but to impose it manually ourselves. I personally feel that more control we have over these settings the better, I'd rather not rely on any 3rd party doing anything sensibly. Thanks, Chris