Hi all,
For any doubters, the reason the defaults changed is very simple. The
entire point of using HTTPS is to a) encrypt the connection and b)
verify that you are connecting to the intended host by verifying their
certificate and such. Not performing both steps means you can
unwittingly connect to a Man-In-The-Middle using a forged certificate
since, with peer verification disabled, the verification checks are
NEVER performed. This is inherently insecure, wrong and makes a HTTPS
connection no different to using HTTP (encryption is merely
established with the forging MITM instead so by itself, encryption is
USELESS.
You can achieve the same level of insecurity by setting cURL's options
to disable peer verification, i.e. cURL has this enabled by default
while PHP's SSL Context has it disabled by default. In fact, PHP's SSL
Context is used for ALL built in HTTPS connections including from
file_get_contents(), DOMDocument::load(), require_once(), etc. They
should all have peer verification and the CA certs configured for the
context whenever such functions are used for HTTPS.
I'll be working on trying to make this more consistently simpler to
configure during the week ahead, the current Zend\Http\Client was
anticipated to be replaced so we never got around to polishing its
rough edges, one of which is Context configuration.
As such, remember that when you experience errors with peer
verification enabled the main cause will likely be a missing or
misconfigured capath. The other cause for failures, outside of the
usual HTTP problems, will be down to invalid, out of date, self-signed
(there's a separate option to enable self-signed certs and it's FALSE
by default), and other such SSL errors that would make your browser
normally complain with a big red screen and dire predictions of your
impending doom ;). Those errors are there for a reason - forged sites
and MITM attacks need to be defended against. Disabling peer
verification deliberately is tantamount to deliberately not escaping
for XSS - it's a self inflicted security vulnerability.
Also, since PHP is therefore insecure by default, please feel free to
complain to someone on the internals team. They might wake up one day
to just how widespread this problem is.
Paddy
On Tue, Aug 14, 2012 at 11:51 AM, Sascha Howe <
[hidden email]> wrote:
>
> See my next message, this reference was a mistake on my part.
>
> Shahar.
>
> On Tue, Aug 14, 2012 at 1:23 PM, Sascha Howe <
[hidden email]>
> wrote:
>>
>> BTW on my Ubuntu servers it starts working properly when I set the
>> Transport option 'sslCaPath' to '/etc/ssl/certs'. This directory is managed
>> by one of the Ubuntu packages, I believe it's called 'ca-certificates'.
>>
>>
>> Hey,
>>
>> are you able to provide an example on how you did this, please? I can't
>> figure out the right place ^^.
>>
>> Any held very welcome.
>>
>> Greetings,
>> Sascha
>>
>>
>
>
>
> Gnarf,
>
> thanks! How could I didn't see this. Thanks for help.
>
> Greetings,
> Sascha
>
>
> Just in case someone else has trouble with this, below is how it worked for
> me with installed ca-certificates package from ubuntu:
>
> Greetings,
> Sascha
>
> $client = new Client();
> $client->setAdapter('\Zend\Http\Client\Adapter\Socket');
> $client->setMethod('GET');
> $stream = $client->getAdapter()->getStreamContext();
> if(!stream_context_set_option($stream,
> array('ssl'=>array('capath'=>'/etc/ssl/certs')))){
> echo "Error setting capath in Streamcontext"; die;
> }
>
> return $client;
--
Pádraic Brady
http://blog.astrumfutura.comhttp://www.survivethedeepend.comZend Framework Community Review Team
Locked
