title: PHP cURL: enforce low TLS version
body: <p>Goal is to write PHP code testing for TLS v1.2 connectivity. Getting a successful answer isn't a problem, but I can't produce a failure by using an older TLS version in PHP. Testing failures is obviously needed to prove correctness of code (to some reasonable degree).</p>
  
  <p>On the command line I could come up with this, giving a clear distinction:</p>
  
  <pre class="lang-none prettyprint-override"><code>$ curl -X POST https://api.paypal.com/v1/oauth2/token 
  {"name":"AUTHENTICATION_FAILURE", [...]
  
  $ curl --tls-max 1.1 -X POST https://api.paypal.com/v1/oauth2/token 
  curl: (35) error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure
  </code></pre>
  
  <p>In PHP I tried this ...</p>
  
  <pre class="lang-php prettyprint-override"><code>$ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, 'https://api.paypal.com/v1/oauth2/token');
  curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_1);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  $response = curl_exec($ch);
  // $response: '{"name":"AUTHENTICATION_FAILURE", [...]
  </code></pre>
  
  <p>... which means a succcessful TLS v1.2 connection, as one can see in the CLI example above, despite TLS v1.1 being requested. It's the same result as when requesting CURL_SSLVERSION_TLSv1_2.</p>
  
  <p>This is PHP 7.3.7 with cURL 7.64.0 and I hope I can get away without recompiling PHP just for disabling TLS v1.2 support.</p>