diff --git a/composer.json b/composer.json
index 586f39c..3e0838e 100644
--- a/composer.json
+++ b/composer.json
@@ -28,7 +28,7 @@
         "source": "https://github.com/jublonet/codebird-php/releases"
     },
     "require": {
-        "php": ">=5.5.0",
+        "php": ">=5.6.0",
         "ext-hash": "*",
         "ext-json": "*",
         "lib-openssl": "*",
diff --git a/src/codebird.php b/src/codebird.php
index 83301ee..53383b3 100644
--- a/src/codebird.php
+++ b/src/codebird.php
@@ -1165,11 +1165,12 @@ protected function _getNoCurlInitialization($url, $contextOptions, $hostname = '
       'User-Agent: codebird-php/' . $this->getVersion() . ' +https://github.com/jublonet/codebird-php'
     ];
 
-    $httpOptions['ssl'] = [
-      'verify_peer'  => true,
-      'cafile'       => __DIR__ . '/cacert.pem',
-      'verify_depth' => 5,
-      'peer_name'    => $hostname
+    $sslOptions = [
+      'verify_peer'      => true,
+      'verify_peer_name' => true,
+      'cafile'           => __DIR__ . '/cacert.pem',
+      'verify_depth'     => 5,
+      'peer_name'        => $hostname
     ];
 
     if ($this->_hasProxy()) {
@@ -1188,6 +1189,11 @@ protected function _getNoCurlInitialization($url, $contextOptions, $hostname = '
       ['http' => $httpOptions]
     );
 
+    // 'ssl' must stay a top-level context key (stream_context_create() ignores
+    // it if nested under 'http') and isn't caller-overridable, so it's assigned
+    // directly rather than merged
+    $options['ssl'] = $sslOptions;
+
     // concatenate $options['http']['header']
     $options['http']['header'] = implode("\r\n", $options['http']['header']);
 
@@ -1905,7 +1911,7 @@ protected function _fetchRemoteFile($url)
       $connection = $this->_getCurlInitialization($url);
       $this->_curl_setopt($connection, CURLOPT_RETURNTRANSFER, 1);
       $this->_curl_setopt($connection, CURLOPT_HEADER, 0);
-      // no SSL validation for downloading media
+      // enforce SSL validation for downloading media
       $this->_curl_setopt($connection, CURLOPT_SSL_VERIFYPEER, 1);
       $this->_curl_setopt($connection, CURLOPT_SSL_VERIFYHOST, 2);
       $this->_curl_setopt($connection, CURLOPT_TIMEOUT_MS, $this->_timeouts['remote']);
@@ -1924,17 +1930,15 @@ protected function _fetchRemoteFile($url)
       return false;
     }
     // no cURL
+    $hostname = parse_url($url, PHP_URL_HOST);
     $contextOptions = [
       'http' => [
         'method'           => 'GET',
         'protocol_version' => '1.1',
         'timeout'          => $this->_timeouts['remote']
-      ],
-      'ssl' => [
-        'verify_peer'  => false
       ]
     ];
-    list($result, $headers) = $this->_getNoCurlInitialization($url, $contextOptions);
+    list($result, $headers) = $this->_getNoCurlInitialization($url, $contextOptions, $hostname);
     if ($result !== false
       && preg_match('/^HTTP\/\d\.\d 200 OK$/', $headers[0])
     ) {