SSL verification is not done correctly

[arekm]

In OpenPayU/HttpCurl.php

         curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
         curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

Peer verification is disabled which is a bit of insane. If curl is built with NSS libraries then setting CURLOPT_SSL_VERIFYPEER to false also disables CURLOPT_SSL_VERIFYHOST which is even worse.

From curl docs https://curl.se/libcurl/c/CURLOPT_SSL_VERIFYHOST.html :

NSS: If CURLOPT_SSL_VERIFYPEER is zero, CURLOPT_SSL_VERIFYHOST is also set to zero and cannot be overridden.

Why ssl verification is done in such insecure way?