Add CHANGES and release notes for [GL ##2691]

diff --git a/CHANGES b/CHANGES
index 1cc5ba0fcef473447b50067e2ce9ec24bcac122d..3d08453efc7ed26aa17dc306714790e0f730d71b 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+5712.  [func]          Add deprecation notice about removing native PKCS#11
+                       support in the next major BIND 9.18 release. [GL #2691]
+
 5711.  [bug]           "map" files exceeding 2GB in size could fail to
                        load due to a size comparison that incorrectly
                        treated the file size as a signed integer. [GL #2878]

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 60791ecf75befd89bc7d9167d90e721aaa27ffe8..b45bc73d57c88c34b81c72452708a694293b38cd 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -39,6 +39,13 @@ Feature Changes
   key. This allows for a gradual replacement of RRSIGs as they reach expiry.
   :gl:`#1551`
 
+- The use of native PKCS#11 for Public-Key Cryptography in BIND 9 has been
+  deprecated in favor of OpenSSL engine_pkcs11 from the OpenSC project.
+  The ``--with-native-pkcs11`` configuration option will be removed from the
+  next major BIND 9 release.  The option to use the engine_pkcs11 OpenSSL
+  engine is already available in BIND 9; please see the ARM section on
+  PKCS#11 for details. :gl:`#2691`
+
 Bug Fixes
 ~~~~~~~~~