title: Does turning off CURLOPT_SSL_VERIFYPEER in cURL make transmission insecure?
body: <p>On the PHP <a href="http://www.php.net/manual/en/function.curl-setopt.php" rel="nofollow">docs page</a> about <code>curl_setopt</code> the most upvoted comment is </p>
  
  <blockquote>
    <p>Please everyone, stop setting CURLOPT_SSL_VERIFYPEER to false or 0. If
    your PHP installation doesn't have an up-to-date CA root certificate
    bundle, download the one at the curl website and save it on your
    server:</p>
    
    <p><a href="http://curl.haxx.se/docs/caextract.html" rel="nofollow">http://curl.haxx.se/docs/caextract.html</a></p>
    
    <p>Then set a path to it in your php.ini file, e.g. on Windows:</p>
    
    <p>curl.cainfo=c:\php\cacert.pem</p>
    
    <p><strong>Turning off CURLOPT_SSL_VERIFYPEER allows man in the middle (MITM)
    attacks, which you don't want!</strong></p>
  </blockquote>
  
  <p>Really? As I understand it, turning off <code>CURLOPT_SSL_VERIFYPEER</code> stops curl from verifying the peer's certificate but data transmission stays secure. Which one is true?</p>