Clarify release notes about create_default_context.

Encourage use of SSLContext on the server side.

diff --git a/docs/releases/v4.2.0.rst b/docs/releases/v4.2.0.rst
index e0fad8c0408fc2eaa2d44ae2c47e12f55bea159e..81476c0bd06e5b4ff906ca0df7b445c28b55e70b 100644 (file)
--- a/docs/releases/v4.2.0.rst
+++ b/docs/releases/v4.2.0.rst
@@ -13,7 +13,9 @@ Backwards-compatibility notes
   of ``certifi`` when possible (i.e. Python 2.7.9+ or 3.4+). This includes
   `.IOStream` and ``simple_httpclient``, but not ``curl_httpclient``.
 * The default SSL configuration has become stricter, using
-  `ssl.create_default_context` where available.
+  `ssl.create_default_context` where available on the client side.
+  (On the server side, applications are encouraged to migrate from the
+  ``ssl_options`` dict-based API to pass an `ssl.SSLContext` instead).
 * The deprecated classes in the `tornado.auth` module, ``GoogleMixin``,
   ``FacebookMixin``, and ``FriendFeedMixin`` have been removed.