Re: [VOTE] Improved TLS Defaults RFC
On 12 February 2014 12:50, Daniel Lowrey <[email protected]> wrote:
> 1. Infinite descent is not an issue because, if unspecified, OpenSSL will
> default to a verify depth of 9 as documented here:
>
> https://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html
I would suggest that we set a default of 9 at the PHP level. I would
prefer not to rely on OpenSSL always having a sane default. What with
the docs (for OpenSSL) being updated so infrequently and people just
generally configuring systems in idiotic ways it makes sense to me to
accept OpenSSL's stated default value, but to impose it manually
ourselves.
I personally feel that more control we have over these settings the
better, I'd rather not rely on any 3rd party doing anything sensibly.
Thanks, Chris
Thread (16 messages)