Fix to the -revoke option in ca. It was leaking memory, crashing and just

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 27a6a80ba67dee5239809a07b1455a35b515b32a..68881ef041269f2e68d6f9dd60747a0d4ef289b7 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,33 @@
 
  Changes between 0.9.4 and 0.9.5  [xx XXX 1999]
 
+  *) Fix the -revoke option in ca. It was freeing up memory twice,
+     leaking and not finding already revoked certificates.
+     [Steve Henson]
+
+  *) Extensive changes to support certificate auxiliary information.
+     This involves the use of X509_CERT_AUX structure and X509_AUX
+     functions. An X509_AUX function such as PEM_read_X509_AUX()
+     can still read in a certificate file in the usual way but it
+     will also read in any additional "auxiliary information". By
+     doing things this way a fair degree of compatability can be
+     retained: existing certificates can have this information added
+     using the new 'x509' options. 
+
+     Current auxiliary information includes an "alias" and some trust
+     settings. The trust settings will ultimately be used in enhanced
+     certificate chain verification routines: currently a certificate
+     can only be trusted if it is self signed and then it is trusted
+     for all purposes.
+     [Steve Henson]
+
+  *) Fix assembler for Alpha (tested only on DEC OSF not Linux or *BSD).  The
+     problem was that one of the replacement routines had not been working since
+     SSLeay releases.  For now the offending routine has been replaced with
+     non-optimised assembler.  Even so, this now gives around 95% performance
+     improvement for 1024 bit RSA signs.
+     [Mark Cox]
+
   *) Hack to fix PKCS#7 decryption when used with some unorthodox RC2 
      handling. Most clients have the effective key size in bits equal to
      the key length in bits: so a 40 bit RC2 key uses a 40 bit (5 byte) key.