From: Daniel Kubec <kubec@openssl.org>
Date: Thu, 13 Nov 2025 08:38:00 +0000 (+0000)
Subject: CHANGES.md: CRL Certificate Issuer and IDP extensions
X-Git-Tag: 4.0-PRE-CLANG-FORMAT-WEBKIT~154
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3f0fb590957763a494163ff64b24975e6c9b437b;p=thirdparty%2Fopenssl.git

CHANGES.md: CRL Certificate Issuer and IDP extensions

Updated CHANGES.md for commit e2990825a238363c4afac60f5f0e335c3fd33f28

Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29136)
---

diff --git a/CHANGES.md b/CHANGES.md
index 6ac08a2ca46..a57ed8ab7fe 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -52,6 +52,11 @@ OpenSSL 4.0
 
    *Igor Ustinov*
 
+ * Reject CRLs with a Certificate Issuer extension in a certificate revocation
+   entry unless the Indirect flag is set to TRUE in the IDP extension of the CRL.
+
+   *Daniel Kubec*
+
 OpenSSL 3.6
 -----------