Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69239
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain adamharvey.name designates 209.85.223.182 as permitted sender)
MIME-Version: 1.0
Sender: adam@adamharvey.name
In-Reply-To: <CAEZPtU6moG46an2nAGUjqyvjbQo+pwRSGAv4PPy8NKAtbKU30g@mail.gmail.com>
References: <CAH8MpnnTGD0xAwG1j9sh10EC6XzdscVRLbJzEMG6qWSBK5c17w@mail.gmail.com>
 <523A466C.4070903@gmail.com> <CAHMUw2HxcWgOBxiK=r4y6FgWF_Gkhgc6BgHxF_bgLLJG9RVxmQ@mail.gmail.com>
 <CAEZPtU7YjNksHLEyH9VzM-iDdpQmBeJkF-BHPkAajZjiQS5XBA@mail.gmail.com>
 <CAHMUw2Gv=JdswmWVHCvp2S3WECVPEx4aWOQzF2yLMHaqJ5HK-g@mail.gmail.com>
 <000001ceb53c$492a3090$db7e91b0$@org> <CAH8MpnkX1p66AxeDXYaDiNaPBL635gKLXmS6qN=veB4H4CTicw@mail.gmail.com>
 <CADajX4BudWBoKwZ8Xo5_QENQifdH2V3MDXe3vGszWkPAbwgjZw@mail.gmail.com> <CAEZPtU6moG46an2nAGUjqyvjbQo+pwRSGAv4PPy8NKAtbKU30g@mail.gmail.com>
Date: Thu, 19 Sep 2013 17:38:46 -0700
Message-ID: <CADajX4Ax-gf-iDMqgx3BNcGM+Wi=hR78iuJVTB=sQXaLgsEVWA@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Re: Re: PHP Crypt functions - security audit
From: aharvey@php.net (Adam Harvey)

On 19 September 2013 17:31, Pierre Joye <pierre.php@gmail.com> wrote:
> On Thu, Sep 19, 2013 at 2:41 PM, Adam Harvey <aharvey@php.net> wrote:
>> As for the CA bundle side of things, I wonder if this is one of those
>> rare times where an ini setting might make sense, as opposed to actual
>> bundling =E2=80=94 that would allow distros to point to their packaged b=
undles
>> without needing to patch php-src, and we could provide from-source
>> installation instructions easily enough to point to common distro
>> locations and the cURL download for users on more exotic OSes (like
>> Windows).
>
> Windows supports that very well, with Curl for example. It can also
> uses the OS certificates database.
>
> For the record here, curl has this setting already:
>
> http://us2.php.net/manual/en/curl.configuration.php#ini.curl.cainfo
>
> which is around for quite some time already.
>
> It could be possible to share it with openssl, but back then I did not
> check it out as only curl was concerned.

Is that something cURL provides, or that we do? A (very) cursory
Google suggests that OpenSSL doesn't have support for the Windows
certificate store natively, so we'd presumably have to patch that up
(with a sensible default php.ini setting, if we went that way =E2=80=94
"ssl.ca_bundle =3D win32", or something similar).

> One thing I do not remember off hand is if we actually enable cert
> validation per default with php's curl. It should be as we discussed
> that already many times.

We do. I checked before the first e-mail. :)

Adam