Re: HTTP_Request2 SSL/TLS issue (was Re: Can I (or Alexey) do a release of HTTP_Request2?)

From:	Alexey Borzov	Date:	Sun, 07 Feb 2016 23:29:26 +0000
Subject:	Re: HTTP_Request2 SSL/TLS issue (was Re: Can I (or Alexey) do a release of HTTP_Request2?)
References:	1 2 3	Groups:	php.pear.dev
Request:	Send a blank email to pear-dev+get-55507@lists.php.net to get a copy of this message

Hi Michael, On 08.02.2016 1:14, Michael Gauthier wrote:

I still need to address http://pear.php.net/bugs/bug.php?id=20462 which can lead to selecting less-secure SSL versions.
Can I help out with this? I have access to an old (Snow Leopard) and a new OS X (El Capitan) machine. Is the current issue just that you are unable to reproduce the issue or do you already have an API update in mind? Let me know if I can help.

Well, it would be nice to know whether the report is reproducible. If you can check on several OS X versions then please do this. And yes, I have some code changes planned, one was mentioned in the next to last comment in #20462: getting rid of insecure SSL versions in HTTP_Request2_SocketWrapper::enableCrypto(). It may also make sense to use some newer knobs if we are running on PHP 5.4+ and/or PHP 5.6+ and to make changes outlined at http://phpsecurity.readthedocs.org/en/latest/Transport-Layer-Security-(HTTPS-SSL-and-TLS).html