PHPMailer/PHPMailer — pull request #339 by AdamWill (2014-12-28 05:47:43+00:00)
Title: attempt to verify SSL/TLS connections by default

This is an alternative approach to issue #196 (compared to
tosiara's PR #197). It attempts a compromise between security
and backward compatibility.

It introduces two new variables, SMTPTLSRequireValidation and
SMTPTLSTrustStore. The former indicates whether certificate
validation is required, and has three settings - null, true,
and false - with null indicating 'not explicitly chosen'. If
set to false, all validation checks are explicitly turned off.
If null or true, we try to find a certificate store, either
from the setting of SMTPTLSTrustStore (if set), from a couple
of well-known locations for the two major distribution groups
(PHP < 5.6), or by simply accepting PHP's default behaviour
which will use OpenSSL's default trust store if possible (PHP >=
5.6). If we cannot find one, secure connections will fail
if RequireValidation is true, or certificate validation will
be disabled and a debug message sent if RequireValidation is
null.

Whenever RequireValidation is true or null, secure connections
will fail if the server host name does not match CN in the
certificate.

The new default behaviour is somewhat tighter than before the
change for PHP versions earlier than 5.6, as previously the
only check was for self-signed certificates (PHP rejects these
by default, at least PHP 5.5 does); the hostname vs. CN check
is new in this case. However, it's a much less major change
than tosiara's approach.