Demac has posted their own solution here:
https://www.demacmedia.com/important-new-patch-magento-canada-post-application/
I have not tested it, but do plan to install it later today (deployment on Friday??? ooooo)
PS: I just received it from Canada Post rep.
UPDATE: just tested it and it's working well. Thanks Demac!
UPDATE (June 13, 2018): this fix will stop working because Canada Post is planning to update the certificates. They suggest using a different way of checking SSL certificate.
I will see if Demac has any solutions for how to change Certificate Pinning that is currently being used in the plugin.
UPDATE: I have asked Canada Post to comment on how exactly they want us to do validation and they mentioned chain "validation" using a PEM file with Certificate Authority certificates.
You can find this answer here: https://forums.canadapost.ca/forum/posts/list/134221.page
// SSL Options
$opts = array('ssl' =>
array(
'verify_peer'=> true,
'cafile' => realpath(dirname($_SERVER['SCRIPT_FILENAME'])) . ‘[PATH TO YOUR TRUSTED CERTIFICATE AUTHORITY PEM FILE]',
‘peer_name' => $hostName
),
'http' => array(
'protocol_version' => 1.0,
),
);
$ctx = stream_context_create($opts);
I looked at Demac's update and confirmed they are already using chain validation in it already.
UPDATE:
I copied over some code from sample PHP code from Canada Post: https://www.canadapost.ca/cpo/mc/assets/zip/developers/samples/CPCWS_SOAP_PHP_Samples.zip
Here is the interpretation of that code in Demac plugin:
// SSL Options
$opts = array('ssl' =>
array(
'verify_peer'=> false,
'cafile' => $cert,
'CN_match' => $this->_location,
'stream_context' => stream_context_create(
array( 'ssl' =>
array( 'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT
)
)
)
)
);
$ctx = stream_context_create($opts);
$client = new SoapClient($wsdl,array('location' => $location, 'features' => SOAP_SINGLE_ELEMENT_ARRAYS, 'stream_context' => $ctx));
It replaced:
$client_options = array(
'location' => $location,
'features' => SOAP_SINGLE_ELEMENT_ARRAYS,
'trace' => 1,
'stream_context' => stream_context_create(
array(
'http' => array(
'protocol_version' => 1.0,
),
)
),
);
if ($this->getConfigData('mode') != 'development')
{
$opts = array(
'ssl' => array(
'verify_peer'=> true,
'cafile' => $cert,
'peer_name' => $this->_location
),
'http' => array(
'protocol_version' => 1.0,
),
);
$ctx = stream_context_create($opts);
$client_options['stream_context'] = $ctx;
}
$client = new SoapClient($wsdl, $client_options);
I also copied PEM file from \CPCWS_SOAP_PHP_Samples\third-party\cert folder of the Sample PHP Code.
Thanks to @Stoyvo for:
array( 'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT
^^^ that helped to resolve logged in / logged out issue I was experiencing on production server.
UPDATE: the back-end is still untested, it is broken and cannot create labels.
UPDATE (WORKING VERSION):
I have no idea how I did this, but this is the latest from production server(production keys) with working label creation:
$client_options = array(
'location' => $location,
'features' => SOAP_SINGLE_ELEMENT_ARRAYS,
'trace' => 1,
'stream_context' => stream_context_create(
array(
'http' => array(
'protocol_version' => 1.0,
),
)
),
);
if ($this->getConfigData('mode') != 'development')
{
$opts = array(
'ssl' => array(
'verify_peer'=> true,
'cafile' => $cert,
'peer_name' => $this->_location
),
'http' => array(
'protocol_version' => 1.0,
),
);
$ctx = stream_context_create($opts);
$client_options['stream_context'] = $ctx;
}
$client = new SoapClient($wsdl, $client_options);