php/php-src — pull request #592 by rdlowrey (2014-02-16 16:23:28+00:00)
Title: Bug #65538

**Bug #65538**

This patch provides support for stream wrapper usage in the `"cafile"` SSL context option. Previously this value was passed directly to the underlying OpenSSL libs and necessarily required an absolute filesystem path. The following behavior now functions as expected:

```php
[
'cafile' => 'phar://myphar/ca.pem',
]]);
$html = file_get_contents('https://github.com', false, $clientCtx);
```

**Security Note**

Note that all stream wrappers *ARE NOT* supported. This is intentional. Consider the security implications of allowing the following code (which users would almost certainly attempt if allowed to do so):

```php
[
'cafile' => 'http://curl.haxx.se/ca/cacert.pem',
]]);
$html = file_get_contents('https://github.com', false, $clientCtx);
```

The use of any stream wrapper that would be disallowed by the `allow_url_fopen=0` php.ini directive will fail with an `E_WARNING` of the form shown below.

```
Warning: remote cafile streams are disabled for security purposes in %s on line %d
```