title: PayPal cURL options (CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST) issue
body: <p>I've got a piece of code from the PayPal site:</p>
  
  <pre><code>// turning off the server and peer verification(TrustManager Concept).
  // really paypal??? why not just include a recent cert???
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
  curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
  </code></pre>
  
  <p>As you can see in my comment I'm wondering why on earth paypal would disable those options.</p>
  
  <p>I know (from previous headaches :) ) that on Windows cURL uses an outdated certs file.</p>
  
  <p>But I have a newer certs file on my server which I could just use:</p>
  
  <pre><code>curl_setopt($ch, CURLOPT_CAINFO, 'E:\path\to\curl-ca-bundle.crt');
  </code></pre>
  
  <p>So why would PayPal 'recommend' disabling it if all it takes is use another (newer) certs file.</p>
  
  <p>Wouldn't that be safer?</p>
  
  <p>Or am I missing something (I'm pretty sure PayPal has enough money for a valid certificate :p )?</p>