Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72808
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGAGxbaZ5aCdSxsQrw05_xyxKEAhQY6uGaoAu06GkudKOtdqoQ@mail.gmail.com>
References: <CAH8MpnnmKt2byQU8DcWetnK6W7GB9HuF3srea-ECwQ4RRe1SWQ@mail.gmail.com>
	<CAGAGxbaZ5aCdSxsQrw05_xyxKEAhQY6uGaoAu06GkudKOtdqoQ@mail.gmail.com>
Date: Tue, 25 Feb 2014 17:38:51 +0100
Message-ID: <CAH-PCH7sku4V43PpjZ6zuYtZOzod4unct54SWCGU23hRtc9CGg@mail.gmail.com>
To: Chris Wright <daverandom@php.net>
Cc: Daniel Lowrey <rdlowrey@gmail.com>, Pierre Joye <pierre.php@gmail.com>, 
	=?UTF-8?Q?P=C3=A1draic_Brady?= <padraic.brady@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c1db6c23262e04f33db9e1
Subject: Re: [PHP-DEV] Windows Peer Verification
From: tyra3l@gmail.com (Ferenc Kovacs)

--001a11c1db6c23262e04f33db9e1
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Sat, Feb 22, 2014 at 1:31 AM, Chris Wright <daverandom@php.net> wrote:

> Following on from this thread and Daniel's excellent work on TLS
> improvements, and liaising heavily with Daniel off-list, I have
> created a PR [1] of some work I have done to get peer verification
> working with Windows native certificate store.
>
> This is by far and away the most preferable option as it gives "out of
> the box" support for peer verification by default on Windows, and does
> not require any additional certificate bundles or configuration. It
> also allows us to take advantage of trust updates rolled out via MS
> update systems.
>
> The implementation is complete in that it supports all existing
> features, although it needs a little polishing and some edge cases
> covering before it can be merged. The only definite known issue at the
> time of writing is that the method for fetching the CN from the
> certificate incorrectly assumes that the returned data will always be
> UTF-8 encoded, a solution for this is planned and will be implemented
> in the next day or two.
>
> I am by no means an expert on the subject matter here in any respect,
> so I encourage ruthless code review.
>
> Note that there are no new features here, it is simply looking to fill
> in the gaps in the recent work by providing consistency on Windows.
>
> [1] https://github.com/php/php-src/pull/601
>

awesome, thank you for putting this together!

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--001a11c1db6c23262e04f33db9e1--