Re: HTTP_Request2 SSL/TLS issue (was Re: Can I (or Alexey) do a release of HTTP_Request2?)

On 2/7/2016 7:29 PM, Alexey Borzov wrote:

Hi Michael, On 08.02.2016 1:14, Michael Gauthier wrote:

I still need to address http://pear.php.net/bugs/bug.php?id=20462 which can lead to selecting less-secure SSL versions.

Can I help out with this? I have access to an old (Snow Leopard) and a new OS X (El Capitan) machine. Is the current issue just that you are unable to reproduce the issue or do you already have an API update in mind? Let me know if I can help.

Well, it would be nice to know whether the report is reproducible. If you can check on several OS X versions then please do this. And yes, I have some code changes planned, one was mentioned in the next to last comment in #20462: getting rid of insecure SSL versions in HTTP_Request2_SocketWrapper::enableCrypto(). It may also make sense to use some newer knobs if we are running on PHP 5.4+ and/or PHP 5.6+ and to make changes outlined at http://phpsecurity.readthedocs.org/en/latest/Transport-Layer-Security-(HTTPS-SSL-and-TLS).html That's a great article. So for the next release the outstanding SSL/TLS features are:

* disable insecure SSL versions by default * in supported PHP/OpenSSL versions, set more secure SSL context options by default Should we also distribute the ca bundle so peer verification works by default? Cheers, Mike