Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:99724
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain kelunik.com from 81.169.146.221 cause and error)
MIME-Version: 1.0
In-Reply-To: <CAESVnVoO-Pe+SQeCn1gywQaZA4z4nL7Mtq+7PwYWeAbP=3juZQ@mail.gmail.com>
References: <CANUQDCiUYNwH_tkZyS_cbWVa1X=4CAA3_14VD+fYjAXk-JU=1g@mail.gmail.com>
 <CANUQDChzB7EYyx8QOPgDC2TPR7n-h-dK43tHDfTZ=ocHPLHSOQ@mail.gmail.com>
 <CAEKnhAH8eGzcUsWODc75_L1kq4OtF2bvR7qJkijWWSVoY7c_mQ@mail.gmail.com>
 <CANUQDChVGuF1rrG3+AVTT+pp0nEmDw7MXyGGX7nVbQ42Kpgytw@mail.gmail.com>
 <CAEKnhAH78Uey_Tp43UY+AVaADi-ckvtBW9EqsuKTj8iDfK+AGQ@mail.gmail.com>
 <CANUQDCivjqg_NN+Zr_ZWWxh8mQyV3JVi1JDSY-ymVoc8ZKyR6w@mail.gmail.com>
 <HE1PR02MB1052A742CD23C1CA9DF54F6EBAD60@HE1PR02MB1052.eurprd02.prod.outlook.com>
 <CANUQDChRXr3FB+fa7744KaBBvawQ+QhLn8z46qAaAdU85pxtbw@mail.gmail.com> <CAESVnVoO-Pe+SQeCn1gywQaZA4z4nL7Mtq+7PwYWeAbP=3juZQ@mail.gmail.com>
Date: Mon, 3 Jul 2017 20:11:45 +0200
Message-ID: <CANUQDChhO7A6by5tcimeEobaP-4k1TRsm4sXh75=K2sCi5HzHQ@mail.gmail.com>
To: Sara Golemon <pollita@php.net>
Cc: Anatol Belski <weltling@outlook.de>, Jakub Zelenka <bukka@php.net>, 
	PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="001a113df2ec2566e005536db3f2"
Subject: Re: [PHP-DEV] Re: [RFC] Distrust SHA-1 Certificates
From: me@kelunik.com (Niklas Keller)

--001a113df2ec2566e005536db3f2
Content-Type: text/plain; charset="UTF-8"

2017-07-03 19:24 GMT+02:00 Sara Golemon <pollita@php.net>:

> On Mon, Jul 3, 2017 at 1:12 PM, Niklas Keller <me@kelunik.com> wrote:
> > Additionally there will be two INI options
> > which are only added to PHP 7.1 and 7.0 to allow people to immediately
> > upgrade to secure defaults without any risk of breaking other apps.
> >
> I understand what you're going for there, but it's just a bit weird to
> have that INI option exist for a weird pair of version ranges and not
> forward.   I'd say keep the INI in 7.2 and (perhaps) mark them
> deprecated.  There's no sense making that upgrade path unreasonably
> difficult.
>

True, but I'd like it to be an INI option to strengthen the security, but
not allow to weaken it. You really shouldn't use MD5 or SHA1 for TLS
certificates 2018 (!). If you really need it there, you can still set a
default stream context option, but we won't clutter the INI options of
future versions.

Regards, Niklas

--001a113df2ec2566e005536db3f2--