It by default doesn't try to verify the certificate of the peer it's connecting to? Isn't that the whole point of introducing TLS support?
Pardon me if I'm missing something, but that sounds like a horrible design decision, and anyone who tries to use TLS streams without reading the documentation is fooled into a false sense of security.
"We must also specify the expected peer name on the presented certificate with the `CN_match` option, it will not be inferred from the URL and if it is not specified, the name on the certificate will not be validated."
WTF? Who ever got the idea that this is something that can ever hit production?
This doesn't matter now. People don't (and sometimes cannot) upgrade quickly. Also, documentation for the latest version still says peer_verify defaults to false and CN_match doesn't mention being computed automatically.
Effectively if you write any code you're not going to deploy yourself, you have to specify the CN_match and verify_peer. Others will not know about the limitations, so this function is messed up until after 5.5 is EOLed.
Designing APIs is hard and bad defaults can hurt for many major versions after they're changed.
The article is somewhat out of date, the default is now to verify (though you can turn it off if you need to). A lot is changing with PHP, and people aren't keeping up.
You mean in the version that's not properly released or anywhere close to production ready? 5.5 still defaults to not verifying according to the documentation.
I did quite clearly state, this information applies to PHP versions before 5.6 (which means that in practice, people need to be doing this for at least the next two years until 5.6 is widely adopted)...
The next article will cover the changes in 5.6 and why you don't need to set those ctx opts any more (and a few more you might want to set instead)
Pardon me if I'm missing something, but that sounds like a horrible design decision, and anyone who tries to use TLS streams without reading the documentation is fooled into a false sense of security.