add HISTORY and CHANGES.md entry for OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR...

Complements: 21722fe5545c "OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR: use new TA(s) for whole transaction (also pkiconf); update doc"

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 11 14:56:47 2026
(Merged from https://github.com/openssl/openssl/pull/29043)

diff --git a/CHANGES.md b/CHANGES.md
index eaeef669351652b4f8a40855ec71d4d5d79e9e05..4e33d004731b45c7ca265eed5bdf9c4f699104da 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -599,6 +599,13 @@ OpenSSL Releases
 
    *Bob Beck*
 
+ * Added `OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR` option for `OSSL_CMP_CTX`
+   and a corresponding `-ta_in_ip_extracert` option for the `openssl cmp` command.
+
+   This work was sponsored by Siemens AG.
+
+   *David von Oheimb*
+
  * `X509_ALGOR_set_md()` function now returns a value indicating success
     or failure.
     <!-- https://github.com/openssl/openssl/pull/17495 -->

diff --git a/doc/man3/OSSL_CMP_CTX_new.pod b/doc/man3/OSSL_CMP_CTX_new.pod
index 415a80161bae4c0d13774fbadecf599875634091..146bdbd0649bdce6a96db55b9e141d919d9f939e 100644 (file)
--- a/doc/man3/OSSL_CMP_CTX_new.pod
+++ b/doc/man3/OSSL_CMP_CTX_new.pod
@@ -894,6 +894,8 @@ OSSL_CMP_CTX_get0_geninfo_ITAVs() were added in OpenSSL 3.3.
 Support for central key generation, requested via B<OSSL_CRMF_POPO_NONE>,
 was added in OpenSSL 3.5.
 
+The B<OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR> option was added in OpenSSL 4.0.
+
 =head1 COPYRIGHT
 
 Copyright 2007-2025 The OpenSSL Project Authors. All Rights Reserved.