@Seldaek That's correct. The problem was that the original `openssl_x509_parse` implementor didn't verify the expected string length against that of the ASN1 string (which can contain null bytes) that results from manually parsing the certificate data. Any parsing of files passed in via the `cafile` stream context is done by the underlying OpenSSL lib and isn't affected by this issue.