Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63237
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain ralphschindler.com from 209.85.219.42 cause and error)
Message-ID: <5061E246.4080508@ralphschindler.com>
Date: Tue, 25 Sep 2012 11:56:38 -0500
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:15.0) Gecko/20120907 Thunderbird/15.0.1
MIME-Version: 1.0
To: internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: OpenSSL Ini Options
From: ralph@ralphschindler.com (Ralph Schindler)

Hey all,

An odd problem has cropped up that I think can be solved at the PHP 
level.  Basically, on Ubuntu (and other distributions), using ssl stream 
context with verify_peer = true could potentially fail.  This is due to 
the fact that OpenSSL, seemingly, only has a compile-time value for 
CApath (that generally can't be changed to my knowledge), does not 
respond to any env. variables and does not take any system specific 
paths into consideration (with the exception of via 
SSL_CTX_load_verify_locations).

In short, what you get is that a script like this:

   https://gist.github.com/3776515

will fail for streams, but pass for cURL.  (The reason cURL passes is 
they sub in default CApaths dependent on the system you're on.)

What I propose is the addition of php.ini settings for a default capath 
that php can use when it is not supplied as an option to the ssl stream 
context:

   ;openssl.capath = '/etc/ssl/cert'

Additionally, I would suggest that if this value is not present in a 
php.ini, we (like curl) stub in a path (default value) at compile time 
that matches the target system as best we can. I've found a list here:

   http://gagravarr.org/writing/openssl-certs/others.shtml

The goal is to be able to influence the capath globally so that all 
streams can take advantage of it when OpenSSL is acting goofy (which is 
default on ubuntu), and when the user has not provided one via he ssl 
steam context option 'capath'.

Basically, I want openssl/php stream ssl to work as well as cURL does.

Hopefully I've explained this clearly enough, thoughts?

-ralph