Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72754
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.178 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGAGxbaZ5aCdSxsQrw05_xyxKEAhQY6uGaoAu06GkudKOtdqoQ@mail.gmail.com>
References: <CAH8MpnnmKt2byQU8DcWetnK6W7GB9HuF3srea-ECwQ4RRe1SWQ@mail.gmail.com>
	<CAGAGxbaZ5aCdSxsQrw05_xyxKEAhQY6uGaoAu06GkudKOtdqoQ@mail.gmail.com>
Date: Fri, 21 Feb 2014 19:58:44 -0500
Message-ID: <CAH8MpnmNdBTJkneGksL71BjY8E_7N_1MXVASQSf3yZ=qVS1S3A@mail.gmail.com>
To: Chris Wright <daverandom@php.net>
Cc: Ferenc Kovacs <tyra3l@gmail.com>, Pierre Joye <pierre.php@gmail.com>, 
	=?ISO-8859-1?Q?P=E1draic_Brady?= <padraic.brady@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=20cf303ea61a835da104f2f43d90
Subject: Re: [PHP-DEV] Windows Peer Verification
From: rdlowrey@gmail.com (Daniel Lowrey)

--20cf303ea61a835da104f2f43d90
Content-Type: text/plain; charset=ISO-8859-1

On Fri, Feb 21, 2014 at 7:31 PM, Chris Wright <daverandom@php.net> wrote:

> Following on from this thread and Daniel's excellent work on TLS
> improvements, and liaising heavily with Daniel off-list, I have
> created a PR [1] of some work I have done to get peer verification
> working with Windows native certificate store.
>
> This is by far and away the most preferable option as it gives "out of
> the box" support for peer verification by default on Windows, and does
> not require any additional certificate bundles or configuration. It
> also allows us to take advantage of trust updates rolled out via MS
> update systems.
>
> The implementation is complete in that it supports all existing
> features, although it needs a little polishing and some edge cases
> covering before it can be merged. The only definite known issue at the
> time of writing is that the method for fetching the CN from the
> certificate incorrectly assumes that the returned data will always be
> UTF-8 encoded, a solution for this is planned and will be implemented
> in the next day or two.
>
> I am by no means an expert on the subject matter here in any respect,
> so I encourage ruthless code review.
>
> Note that there are no new features here, it is simply looking to fill
> in the gaps in the recent work by providing consistency on Windows.
>
> [1] https://github.com/php/php-src/pull/601
>

Count me as a big +1 on this. Delegating out to the OS is the only good
solution and managing/distributing our own CA store is asking for trouble.
That said, I don't have any familiarity with the windows APIs in this area.
I'll be testing, poking and prodding the code in the next couple of days,
though.

--20cf303ea61a835da104f2f43d90--