Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94505
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain belski.net from 85.214.73.107 cause and error)
To: "'Jakub Zelenka'" <bukka@php.net>,
	"'PHP internals list'" <internals@lists.php.net>
References: <CAEKnhAHMzaKbd088JUFRe6i_OwCcQYXabZ22rB5R9qXQPk-u0Q@mail.gmail.com>
In-Reply-To: <CAEKnhAHMzaKbd088JUFRe6i_OwCcQYXabZ22rB5R9qXQPk-u0Q@mail.gmail.com>
Date: Thu, 14 Jul 2016 10:15:01 +0200
Message-ID: <016601d1dda7$d3d14800$7b73d800$@belski.net>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Thread-Index: AQJP++ay3XWqBmWQ7JcsU1MP8IObdp8bTH0A
Content-Language: en-us
Subject: RE: [PHP-DEV] Dropping SSL2 in 7.1
From: anatol.php@belski.net ("Anatol Belski")

Hi Jakub,

> -----Original Message-----
> From: jakub.php@gmail.com [mailto:jakub.php@gmail.com] On Behalf Of =
Jakub
> Zelenka
> Sent: Wednesday, July 13, 2016 9:11 PM
> To: PHP internals list <internals@lists.php.net>
> Subject: [PHP-DEV] Dropping SSL2 in 7.1
>=20
> Hi,
>=20
> It's been already proposed by Remi using PR [1] so sending it here as =
well.
> I would like to proceed and drop SSL2 support from PHP. Effectively it =
means
> dropping ssl2 stream as it's not already negotiated by default.
>=20
> It's been dropped in OpenSSL 1.1 and we don't already support it with =
1.0.2.
> Considering that I will be merging dropping support for 0.9.8 and
> 1.0.0 shortly, it leaves just 1.0.1 that would support it. Considering =
also the
> possible security issues, I think there is no reason to keep it.
>=20
> Please let me know if any objections.
>=20
> [1] https://github.com/php/php-src/pull/1826
>=20
To be mentioned, even the currently active OpenSSL branches disable =
SSLv2 by default nowadays. Here's the info =
https://openssl.org/news/secadv/20160301.txt=20

Regards

Anatol