Re: [RFC] Distrust SHA-1 Certificates

> > > SSL_CTX_set1_sigalgs is anyway only supported starting in OpenSSL 1.0.2, > > so we need a custom verify callback for older OpenSSL versions. In our > own > > verify callback we can use a blacklist instead of the suggested whitelist > > by default. > > > > > No need to add support for 1.0.1 as it's going to be EOL end of December. > Lower version are EOL already. > That may be true, but we only raised the minimum requirement for newer versions of PHP. If this is going to be backported for PHP 5.6 / 7.0 / 7.1, we have to support those older OpenSSL versions I guess? Regards, Niklas