Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72338
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.171 as permitted sender)
MIME-Version: 1.0
Date: Thu, 6 Feb 2014 08:55:35 -0500
Message-ID: <CAH8Mpn=LOWn1EkaoeZBd+Rp9WM7fLMMLm-LJAnSNohH19Hmf_g@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7bdc08aa4a21de04f1bd3a67
Subject: Re: Re: Windows Peer Verification
From: rdlowrey@gmail.com (Daniel Lowrey)

--047d7bdc08aa4a21de04f1bd3a67
Content-Type: text/plain; charset=ISO-8859-1

> Neither plain-text download nor unverified TLS should be used for
> the trusted CA root list.

What follows is more general information than an answer. I'm simply
copy/pasting curl's explanation for this question. The original can be
found here (http://curl.haxx.se/docs/caextract.html):

    Yes, pointing out that this contents is not hosted on a HTTPS
    site is a popular thing to do but really it doesn't help anyone,
    nor does it bring any news.

    If you don't trust the data or want to be more certain: run the
    script yourself. Offering the data over HTTPS would give you a
    chicken-and-egg problem as which CAs would you trust when
    you download the bundle? You're free to run your own caextract
    service on a HTTPS site to redeem this. The scripts and everything
    we use to offer data on this page are available in the curl source
    code tree.

--047d7bdc08aa4a21de04f1bd3a67--