From: Markus Minichmayr <markus@tapkey.com>
Date: Wed, 22 Nov 2023 16:43:27 +0000 (+0100)
Subject: PreferNoDHEKEX changelog and history anticipating inclusion in OpenSSL version 3.3.
X-Git-Tag: openssl-3.3.0-alpha1~571
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dfc836c346cc6001534eaf9ed3a151b7aa658335;p=thirdparty%2Fopenssl.git

PreferNoDHEKEX changelog and history anticipating inclusion in OpenSSL version 3.3.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22794)
---

diff --git a/CHANGES.md b/CHANGES.md
index 81044b3d707..93365619fa8 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -45,6 +45,12 @@ OpenSSL 3.3
 
    *Ahelenia Ziemiańska*
 
+ * New option `SSL_OP_PREFER_NO_DHE_KEX`, which allows configuring a TLS1.3
+   server to prefer session resumption using PSK-only key exchange over PSK
+   with DHE, if both are available.
+
+   *Markus Minichmayr, Tapkey GmbH*
+
 OpenSSL 3.2
 -----------
 
diff --git a/doc/man3/SSL_CONF_cmd.pod b/doc/man3/SSL_CONF_cmd.pod
index a0e4d52892c..54ab886af10 100644
--- a/doc/man3/SSL_CONF_cmd.pod
+++ b/doc/man3/SSL_CONF_cmd.pod
@@ -789,6 +789,8 @@ OpenSSL 3.0.
 The B<TxCertificateCompression> and B<RxCertificateCompression> options were
 added in OpenSSL 3.2.
 
+B<PreferNoDHEKEX> was added in OpenSSL 3.3.
+
 =head1 COPYRIGHT
 
 Copyright 2012-2023 The OpenSSL Project Authors. All Rights Reserved.