Description:
------------
The streams API doesn't appear to actually call the error callback. This is definitely true if the connection fails, or if the expected hostname doesn't match the SSL certificate. In the latter case, there is no reliable way of detecting the error.

The reproduce code is a cut-down version of a test script being run through the CLI, while I figure out the streams API. I get the same behavior from 5.2.3 and 5.2.4RC2.

Reproduce code:
---------------
<?php

$HOST_NAME = 'secureservicesonline.com';
$CA_DIR = '/etc/ssl/certs'; // change this if needed

function stream_err() {
  $args = func_get_args();
  echo("[stream_err, args=");
  print_r($args); // which are undocumented, btw
  echo("]\n");
}

$ctx = stream_context_create(array('ssl'=>array('verify_peer' => true, 'CN_match' => "$HOST_NAME.invalid", 'capath'=>$CA_DIR)));
$ret = stream_context_set_params($ctx, array('notification'=>'stream_err'));

var_dump($ret);

$errno = $errstr = null;
$fp = stream_socket_client("ssl://$HOST_NAME:443", $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $ctx);

var_dump($errno);
var_dump($errstr);

if( $fp !== false ) {
  fclose($fp);
}

?>

Expected result:
----------------
[stream_err, args=Array ( ...... )]

Actual result:
--------------
PHP Warning:  stream_socket_client(): Peer certificate CN=`secureservicesonline.com' did not match expected CN=`secureservicesonline.com.invalid' in /.../https_client.php on line 52

Warning: stream_socket_client(): Peer certificate CN=`secureservicesonline.com' did not match expected CN=`secureservicesonline.com.invalid' in /.../https_client.php on line 52