Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:99732
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain daveyshafik.com from 209.85.220.169 cause and error)
MIME-Version: 1.0
Sender: me@daveyshafik.com
In-Reply-To: <CANUQDChhO7A6by5tcimeEobaP-4k1TRsm4sXh75=K2sCi5HzHQ@mail.gmail.com>
References: <CANUQDCiUYNwH_tkZyS_cbWVa1X=4CAA3_14VD+fYjAXk-JU=1g@mail.gmail.com>
 <CANUQDChzB7EYyx8QOPgDC2TPR7n-h-dK43tHDfTZ=ocHPLHSOQ@mail.gmail.com>
 <CAEKnhAH8eGzcUsWODc75_L1kq4OtF2bvR7qJkijWWSVoY7c_mQ@mail.gmail.com>
 <CANUQDChVGuF1rrG3+AVTT+pp0nEmDw7MXyGGX7nVbQ42Kpgytw@mail.gmail.com>
 <CAEKnhAH78Uey_Tp43UY+AVaADi-ckvtBW9EqsuKTj8iDfK+AGQ@mail.gmail.com>
 <CANUQDCivjqg_NN+Zr_ZWWxh8mQyV3JVi1JDSY-ymVoc8ZKyR6w@mail.gmail.com>
 <HE1PR02MB1052A742CD23C1CA9DF54F6EBAD60@HE1PR02MB1052.eurprd02.prod.outlook.com>
 <CANUQDChRXr3FB+fa7744KaBBvawQ+QhLn8z46qAaAdU85pxtbw@mail.gmail.com>
 <CAESVnVoO-Pe+SQeCn1gywQaZA4z4nL7Mtq+7PwYWeAbP=3juZQ@mail.gmail.com> <CANUQDChhO7A6by5tcimeEobaP-4k1TRsm4sXh75=K2sCi5HzHQ@mail.gmail.com>
Date: Mon, 3 Jul 2017 23:53:17 -0700
Message-ID: <CANaX5neE62ttodm3=PkyoSwYVaS5GXt4rGjNwLNiP9Qs791Ccw@mail.gmail.com>
To: Niklas Keller <me@kelunik.com>
Cc: Sara Golemon <pollita@php.net>, Anatol Belski <weltling@outlook.de>, Jakub Zelenka <bukka@php.net>, 
	PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="001a1148b410a51b3c05537856f4"
Subject: Re: [PHP-DEV] Re: [RFC] Distrust SHA-1 Certificates
From: davey@php.net (Davey Shafik)

--001a1148b410a51b3c05537856f4
Content-Type: text/plain; charset="UTF-8"

It should be noted that Certificate Authorities (CAs) haven't been issuing
SHA-1 certs since December 31st 2015.

I think the best solution if possible, would be to treat MD5 and SHA-1
certs as invalid in _all_ supported versions of PHP and requiring that
the verify_peer
option be set to false to accept them.

For PHP 7.2 also add deprecation notices.

For PHP 7.3 and later, remove support completely.

On Mon, Jul 3, 2017 at 11:11 AM, Niklas Keller <me@kelunik.com> wrote:

> 2017-07-03 19:24 GMT+02:00 Sara Golemon <pollita@php.net>:
>
> > On Mon, Jul 3, 2017 at 1:12 PM, Niklas Keller <me@kelunik.com> wrote:
> > > Additionally there will be two INI options
> > > which are only added to PHP 7.1 and 7.0 to allow people to immediately
> > > upgrade to secure defaults without any risk of breaking other apps.
> > >
> > I understand what you're going for there, but it's just a bit weird to
> > have that INI option exist for a weird pair of version ranges and not
> > forward.   I'd say keep the INI in 7.2 and (perhaps) mark them
> > deprecated.  There's no sense making that upgrade path unreasonably
> > difficult.
> >
>
> True, but I'd like it to be an INI option to strengthen the security, but
> not allow to weaken it. You really shouldn't use MD5 or SHA1 for TLS
> certificates 2018 (!). If you really need it there, you can still set a
> default stream context option, but we won't clutter the INI options of
> future versions.
>
> Regards, Niklas
>

--001a1148b410a51b3c05537856f4--