Remainder of SSL purpose and trust code: trust and purpose setting in

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index fa00300ebe67f06852cbb0323b885269ceee126a..8b033f42bf6671e4b3bbab4e0e5b6a2042e90f91 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -17,9 +17,8 @@
      when the X509_STORE_CTX structure is set up) and checks the pathlength.
 
      There is a NO_CHAIN_VERIFY compilation option to keep the old behaviour:
-     this is because when it is finally working it will reject chains with
-     invalid extensions whereas every previous version of OpenSSL and SSLeay
-     made no checks at all.
+     this is because it will reject chains with invalid extensions whereas
+     every previous version of OpenSSL and SSLeay made no checks at all.
 
      Trust code: checks the root CA for the relevant trust settings. Trust
      settings have an initial value consistent with the verify purpose: e.g.
@@ -32,6 +31,10 @@
      which should be used for version portability: especially since the
      verify structure is likely to change more often now.
 
+     SSL integration. Add purpose and trust to SSL_CTX and SSL and functions
+     to set them. If not set then assume SSL clients will verify SSL servers
+     and vice versa.
+
      Two new options to the verify program: -untrusted allows a set of
      untrusted certificates to be passed in and -purpose which sets the
      intended purpose of the certificate. If a purpose is set then the