Make tls1_check_chain return a set of flags indicating checks passed

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 7b58b296032e6a766c35cffdc2596e83251c0c5a..08a67fbd1b48289ccb8c256d3ebfc92b4cad23f8 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -8,6 +8,21 @@
      OID NID.
      [Steve Henson]
 
+  *) Make tls1_check_chain return a set of flags indicating checks passed
+     by a certificate chain. Add additional tests to handle client
+     certificates: checks for matching certificate type and issuer name
+     comparison.
+     [Steve Henson]
+
+  *) If an attempt is made to use a signature algorithm not in the peer
+     preference list abort the handshake. If client has no suitable
+     signature algorithms in response to a certificate request do not
+     use the certificate.
+     [Steve Henson]
+
+  *) If server EC tmp key is not in client preference list abort handshake.
+     [Steve Henson]
+
   *) Add support for certificate stores in CERT structure. This makes it
      possible to have different stores per SSL structure or one store in
      the parent SSL_CTX. Include distint stores for certificate chain