Add support for CRLs partitioned by reason code.

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 9b524ddcfe36b7a20e77833058aa818e31a018f2..6e1bf9c0a4a220410e977e93a989bc8494f4449b 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,56 @@
 
  Changes between 0.9.8i and 0.9.9  [xx XXX xxxx]
 
+  *) Support for CRLs partitioned by reason code. Reorganise CRL processing
+     code and add additional score elements. Validate alternate CRL paths
+     as part of the CRL checking and indicate a new error "CRL path validation
+     error" in this case. Applications wanting additional details can use
+     the verify callback and check the new "parent" field. If this is not
+     NULL CRL path validation is taking place. Existing applications wont
+     see this because it requires extended CRL support which is off by
+     default.
+
+     This work was sponsored by Google.
+     [Steve Henson]
+
+  *) Support for freshest CRL extension.
+
+     This work was sponsored by Google.
+     [Steve Henson]
+
+  *) Initial indirect CRL support. Currently only supported in the CRLs
+     passed directly and not via lookup. Process certificate issuer
+     CRL entry extension and lookup CRL entries by bother issuer name
+     and serial number. Check and process CRL issuer entry in IDP extension.
+
+     This work was sponsored by Google.
+     [Steve Henson]
+
+  *) Add support for distinct certificate and CRL paths. The CRL issuer
+     certificate is validated separately in this case. Only enabled if
+     an extended CRL support flag is set: this flag will enable additional
+     CRL functionality in future.
+
+     This work was sponsored by Google.
+     [Steve Henson]
+
+  *) Add support for policy mappings extension.
+
+     This work was sponsored by Google.
+     [Steve Henson]
+
+  *) Fixes to pathlength constraint, self issued certificate handling,
+     policy processing to align with RFC3280 and PKITS tests.
+
+     This work was sponsored by Google.
+     [Steve Henson]
+
+  *) Support for name constraints certificate extension. DN, email, DNS
+     and URI types are currently supported.
+
+     This work was sponsored by Google.
+     [Steve Henson]
+
   *) To cater for systems that provide a pointer-based thread ID rather
      than numeric, deprecate the current numeric thread ID mechanism and
      replace it with a structure and associated callback type. This
@@ -17,6 +67,11 @@
      CRYPTO_THREADID_set_callback() to register a callback that will call
      either CRYPTO_THREADID_set_numeric() or CRYPTO_THREADID_set_pointer().
 
+     Note that ERR_remove_state() is now deprecated, because it is tied
+     to the assumption that thread IDs are numeric.  ERR_remove_state(0)
+     to free the current thread's error state should be replaced by
+     ERR_remove_thread_state(NULL).
+
      (This new approach replaces the functions CRYPTO_set_idptr_callback(),
      CRYPTO_get_idptr_callback(), and CRYPTO_thread_idptr() that existed in
      OpenSSL 0.9.9-dev between June 2006 and August 2008. Also, if an
@@ -31,6 +86,8 @@
   *) Initial support for different CRL issuing certificates. This covers a
      simple case where the self issued certificates in the chain exist and
      the real CRL issuer is higher in the existing chain.
+
+     This work was sponsored by Google.
      [Steve Henson]
 
   *) Removed effectively defunct crypto/store from the build.