Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72516
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.172 as permitted sender)
MIME-Version: 1.0
Sender: are.you.winning@gmail.com
In-Reply-To: <CAH8MpnmorTAjYoPG_ApCYSV0QYJiDu79Hx7O9i76XYomO6_hGg@mail.gmail.com>
References: <CAH8Mpn=dhpKEM_fU=zq0JRx9G0mrD_E6duAu=Sz-6++Qt-TO_g@mail.gmail.com>
	<52FA932D.5050504@sugarcrm.com>
	<CAH8MpnnC6-gR5REPciKM4nXkXtquP3q5Z00d+WkA+Kz5vak4ZA@mail.gmail.com>
	<CALwr1GnO+j2zDk+ykgF4E5O=quSOUPiZCcBbpmaqbH34j6xU0g@mail.gmail.com>
	<CAH8MpnmorTAjYoPG_ApCYSV0QYJiDu79Hx7O9i76XYomO6_hGg@mail.gmail.com>
Date: Wed, 12 Feb 2014 13:08:41 +0000
Message-ID: <CAGAGxbZw2xRM2K1KWA_q1WGJ7qS0Wsd-JjU9M7G1M6A213gzsg@mail.gmail.com>
To: Daniel Lowrey <rdlowrey@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] [VOTE] Improved TLS Defaults RFC
From: daverandom@php.net (Chris Wright)

On 12 February 2014 12:50, Daniel Lowrey <rdlowrey@gmail.com> wrote:
> 1. Infinite descent is not an issue because, if unspecified, OpenSSL will
> default to a verify depth of 9 as documented here:
>
> https://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html

I would suggest that we set a default of 9 at the PHP level. I would
prefer not to rely on OpenSSL always having a sane default. What with
the docs (for OpenSSL) being updated so infrequently and people just
generally configuring systems in idiotic ways it makes sense to me to
accept OpenSSL's stated default value, but to impose it manually
ourselves.

I personally feel that more control we have over these settings the
better, I'd rather not rely on any 3rd party doing anything sensibly.

Thanks, Chris