- * The X25519, X448, Ed25519, Ed448 and SHAKE256 algorithms are included in
- the FIPS provider. None have the "fips=yes" property set and, as such,
- will not be accidentially used.
- * The algorithm specific public key command line applications have
- been deprecated. These include dhparam, gendsa and others. The pkey
- alternatives should be used intead: pkey, pkeyparam and genpkey.
+ * Subject or issuer names in X.509 objects are now displayed as UTF-8 strings
+ by default.
+
+OpenSSL 3.0
+-----------
+
+### Major changes between OpenSSL 1.1.1 and OpenSSL 3.0
+
+ * Enhanced 'openssl list' with many new options.
+ * Added migration guide to man7.
+ * Implemented support for fully "pluggable" TLSv1.3 groups.
+ * Added suport for Kernel TLS (KTLS).
+ * Changed the license to the Apache License v2.0.
+ * Moved all variations of the EVP ciphers CAST5, BF, IDEA, SEED, RC2,
+ RC4, RC5, and DES to the legacy provider.
+ * Moved the EVP digests MD2, MD4, MDC2, WHIRLPOOL and RIPEMD-160 to the legacy
+ provider.
+ * Added convenience functions for generating asymmetric key pairs.
+ * Deprecated the `OCSP_REQ_CTX` type and functions.
+ * Deprecated the `EC_KEY` and `EC_KEY_METHOD` types and functions.
+ * Deprecated the `RSA` and `RSA_METHOD` types and functions.
+ * Deprecated the `DSA` and `DSA_METHOD` types and functions.
+ * Deprecated the `DH` and `DH_METHOD` types and functions.
+ * Deprecated the `ERR_load_` functions.
+ * Remove the `RAND_DRBG` API.
+ * Deprecated the `ENGINE` API.
+ * Added `OSSL_LIB_CTX`, a libcrypto library context.
+ * Added various `_ex` functions to the OpenSSL API that support using
+ a non-default `OSSL_LIB_CTX`.
+ * Interactive mode is removed from the 'openssl' program.
+ * The X25519, X448, Ed25519, Ed448, SHAKE128 and SHAKE256 algorithms are
+ included in the FIPS provider.