Initial indirect CRL support.

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index cede85628b5596026ffe0b9f9bc2d063441f5846..15ad43999041ec60a1aa6a125eb3890218f30830 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,22 @@
 
  Changes between 0.9.8i and 0.9.9  [xx XXX xxxx]
 
+  *) Initial indirect CRL support. Currently only supported in the CRLs
+     passed directly and not via lookup. Process certificate issuer
+     CRL entry extension and lookup CRL entries by bother issuer name
+     and serial number. Check and proces CRL issuer entry in IDP extension.
+
+     This work was sponsored by Google.
+     [Steve Henson]
+
+  *) Add support for distinct certificate and CRL paths. The CRL issuer
+     certificate is validated separately in this case. Only enabled if
+     an extended CRL support flag is set: this flag will enable additional
+     CRL functionality in future.
+
+     This work was sponsored by Google.
+     [Steve Henson]
+
   *) Add support for policy mappings extension.
 
      This work was sponsored by Google.
@@ -34,6 +50,11 @@
      CRYPTO_THREADID_set_callback() to register a callback that will call
      either CRYPTO_THREADID_set_numeric() or CRYPTO_THREADID_set_pointer().
 
+     Note that ERR_remove_state() is now deprecated, because it is tied
+     to the assumption that thread IDs are numeric.  ERR_remove_state(0)
+     to free the current thread's error state should be replaced by
+     ERR_remove_thread_state(NULL).
+
      (This new approach replaces the functions CRYPTO_set_idptr_callback(),
      CRYPTO_get_idptr_callback(), and CRYPTO_thread_idptr() that existed in
      OpenSSL 0.9.9-dev between June 2006 and August 2008. Also, if an