Phalcon DI container and HTTP service TLS context propagation

A design is being considered for an HTTPS-backed microservice using Phalcon 5.x where the Dependency Injection container binds an HTTP client service with a custom certificate validator. The goal is to have framework-level TLS settings consistently apply to all injected HTTP clients without per-service duplication.

Phalcon's DI supports binding custom validators, but certificate validation callbacks require explicit configuration and framework-level TLS settings do not automatically propagate to injected services. Phalcon 5.x changed internal APIs for service providers and event manager hooks compared with 4.x, and certificate validation behavior is also influenced by the underlying OpenSSL version and PHP stream context settings. It is unclear where the integration boundary lies between the C-extension core and the PHP application layer for TLS context resolution.

Does Phalcon's DI container auto-resolve TLS stream contexts for services that wrap PHP streams, or must a stream context be explicitly bound for each injected HTTP client? Under which conditions do framework-level TLS defaults propagate to a custom validator bound in the container? How should TLS context ownership be documented at the integration boundary between Phalcon's C-extension core and PHP application code?