get_config('cacertinfo') will be null in default installs unless overridden, a default should be used

[Hugh Davenport]

htdocs/lib/web.php line 3532

This config variable is both undocumented, and no default is given. I think that we should try and detect some reasonable default and give up if none possible. Documentation could also be good ;)

It appears to be only used in that one place, as a flag to set up more checks.

[Aaron Wells (u-aaronw)]

What this config does is provides for PHP curl to verify the certificates of HTTPS servers that it connects to. Without this, it apparently just trusts anything.

We can perhaps copy the logic from https://tracker.moodle.org/browse/MDL-39356 , where Moodle recently implemented something similar. They appear to have included the cacert.pem from http://curl.haxx.se/docs/caextract.html

[Aaron Wells (u-aaronw)]

Note that if we did fix this, there appear to be a few other places we'd want to update as well, such as the api/xmlrpc libraries. Searching for CURLOPT_SSL_VERIFYPEER helps turn up afew.

[Aaron Wells (u-aaronw)]

Here's a patch to document it, at least: https://reviews.mahara.org/2633

[Aaron Wells (u-aaronw)]

Patch 2633 was merged in to the master branch in time for inclusion in the 1.8.0 release. I'm leaving this bug open, though, because we still need to provide a default cacert.pem file like Moodle.