From 3f0fb590957763a494163ff64b24975e6c9b437b Mon Sep 17 00:00:00 2001
From: Daniel Kubec <kubec@openssl.org>
Date: Thu, 13 Nov 2025 08:38:00 +0000
Subject: [PATCH] CHANGES.md: CRL Certificate Issuer and IDP extensions

Updated CHANGES.md for commit e2990825a238363c4afac60f5f0e335c3fd33f28

Co-authored-by: Viktor Dukhovni <viktor1ghub@dukhovni.org>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29136)
---
 CHANGES.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/CHANGES.md b/CHANGES.md
index 6ac08a2ca46..a57ed8ab7fe 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -52,6 +52,11 @@ OpenSSL 4.0
 
    *Igor Ustinov*
 
+ * Reject CRLs with a Certificate Issuer extension in a certificate revocation
+   entry unless the Indirect flag is set to TRUE in the IDP extension of the CRL.
+
+   *Daniel Kubec*
+
 OpenSSL 3.6
 -----------
 
-- 
2.47.3