# Improved TLS Defaults

- Thread: https://externals.io/message/72010
- Original archive: https://news-web.php.net/php.internals/72010
- Started by Daniel Lowrey on 2014-02-02T17:43:04+00:00
- Messages: 4
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #72010 — Daniel Lowrey — 2014-02-02T17:43:04+00:00

URL: https://externals.io/message/72010#72010

Hi internals!

I've made another minor addition to the Improved TLS Defaults RFC for those
interested ...

Userland can now access information about the negotiated protocol/cipher
for a given stream via the context:

https://wiki.php.net/rfc/improved-tls-defaults#expose_negotiated_values

---

## #72013 — padraic.brady@gmail.com — 2014-02-02T19:38:13+00:00

URL: https://externals.io/message/72010#72013 · In reply to: #72010

Hey Daniel,



> Hi internals!
>
> I've made another minor addition to the Improved TLS Defaults RFC for those
> interested ...
>
> Userland can now access information about the negotiated protocol/cipher
> for a given stream via the context:
>
> https://wiki.php.net/rfc/improved-tls-defaults#expose_negotiated_values
>

I think that's a really good addition from the perspective of figuring out
what's going on for any given server.

--
Pádraic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative

---

## #72033 — Yasuo Ohgaki — 2014-02-03T01:58:33+00:00

URL: https://externals.io/message/72010#72033 · In reply to: #72013

Hi Daniel,

On Mon, Feb 3, 2014 at 4:38 AM, Pádraic Brady <padraic.brady@gmail.com>wrote:

> Hey Daniel,
>
> 
>
> > […]
> those
> > […]
>
> I think that's a really good addition from the perspective of figuring out
> what's going on for any given server.
>

I think it's great, too.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

---

## #72113 — Daniel Lowrey — 2014-02-03T20:09:16+00:00

URL: https://externals.io/message/72010#72113 · In reply to: #72033

I forgot to mention it, but I've also added another function to the
Improved TLS Defaults RFC:

 `openssl_get_cert_locations()`

This should make it easier to debug CA file issues by coalescing all the
locations where PHP might look for a CA cert in one place. The new function
allows easier debugging as well as tooling to check if existing php.ini
settings or OS-assigned defaults can locate CA files are appropriate to
allow secure peer verification.

The update can be seen here:

https://wiki.php.net/rfc/improved-tls-defaults#expose_default_cert_paths