It should be noted that Certificate Authorities (CAs) haven't been issuing SHA-1 certs since December 31st 2015.
I think the best solution if possible, would be to treat MD5 and SHA-1 certs as invalid in _all_ supported versions of PHP and requiring that the verify_peer option be set to false to accept them. For PHP 7.2 also add deprecation notices. For PHP 7.3 and later, remove support completely. On Mon, Jul 3, 2017 at 11:11 AM, Niklas Keller <m...@kelunik.com> wrote: > 2017-07-03 19:24 GMT+02:00 Sara Golemon <poll...@php.net>: > > > On Mon, Jul 3, 2017 at 1:12 PM, Niklas Keller <m...@kelunik.com> wrote: > > > Additionally there will be two INI options > > > which are only added to PHP 7.1 and 7.0 to allow people to immediately > > > upgrade to secure defaults without any risk of breaking other apps. > > > > > I understand what you're going for there, but it's just a bit weird to > > have that INI option exist for a weird pair of version ranges and not > > forward. I'd say keep the INI in 7.2 and (perhaps) mark them > > deprecated. There's no sense making that upgrade path unreasonably > > difficult. > > > > True, but I'd like it to be an INI option to strengthen the security, but > not allow to weaken it. You really shouldn't use MD5 or SHA1 for TLS > certificates 2018 (!). If you really need it there, you can still set a > default stream context option, but we won't clutter the INI options of > future versions. > > Regards, Niklas >
