Certificate of maps.googleapis.com not trusted when fallback to Mozilla CA bundle is used about ca-bundle

[Seldaek]

BTW Nov 2 bundle is out and I can confirm that finally the google domain issue is resolved so no more hacky restoration of deleted certs needed. We now use the raw bundle.

[Seldaek]

Fixed in 1.0.2 by a2995e5

[Seldaek]

See also cakephp/cakephp#8608 (comment) for details

[JanPetterMG]

Has anyone ever verified this issue?
And why isn't it using CaBundle::getBundledCaBundlePath()?

As far as I can see, there is a possibility that the above test was using a local system ca-bundle instead of the now patched ca-bundle provided by this library. What path did it return, that's essential to know in cases like these.

For the sake of security, we need to be 100% sure it's a composer/ca-bundle problem before we patch anything!

[janedbal]

@JanPetterMG I'm able to reproduce this issue even now on PHP 5.6 with getBundledCaBundlePath when using composer/ca-bundle 1.0.1. The issue disappears when I switch to PHP 7, which is weird to me (maybe some relation to bundled openssl in PHP 7?)

[JanPetterMG]

@janedbal Okay, then it's verified and we're all good 👍
It's all about the security. If I can't trust the changes, I can't trust the library either, that simple it is...

[JanPetterMG]

I can't verify this myself, no errors at all. Tested both v1.0.1 (bundle 2016-01-20) and PR #6 (bundle 2016-04-20). Running PHP v5.6.20. It might be the setup?
I would really appreciate if a 3rd person could test if this issue is still present in PR #6.

[Seldaek]

I can confirm that I can still reproduce the issue with the new CAbundle, so the new release still comes with Equifax added.. http://security.stackexchange.com/a/53271 has some details about this but I haven't read in depth.

[janedbal]

@Seldaek Are you sure? I'm still experiencing the same issue even on the Nov 2 bundle tagged as 1.0.5 (PHP 5.6 with getBundledCaBundlePath). Version 1.0.4 works fine. On PHP 7, everything is ok as mentioned before.

[Seldaek]

Ah crap I forgot it was working with php7 sorry.. Didn't test with <7. I guess we'll have to restore the cert again then.