Initial CRL based revocation checking.

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 2d32583ed171446af2d3c316fefa7a775052b62d..c49d03ae392157f68466706dffca74438a2fcb1f 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -11,6 +11,21 @@
          *) applies to 0.9.6a (/0.9.6b) and 0.9.7
          +) applies to 0.9.7 only
 
+  +) Initial CRL based revocation checking. If the CRL checking flag(s)
+     are set then the CRL is looked up in the X509_STORE structure and
+     its validity and signature checked, then if the certificate is found
+     in the CRL the verify fails with a revoked error.
+
+     Various new CRL related callbacks added to X509_STORE_CTX structure.
+
+     Command line options added to 'verify' application to support this.
+
+     This needs some additional work, such as being able to handle multiple
+     CRLs with different times, extension based lookup (rather than just
+     by subject name) and ultimately more complete V2 CRL extension
+     handling.
+     [Steve Henson]
+
   +) Add a general user interface API.  This is designed to replace things
      like des_read_password and friends (backward compatibility functions
      using this new API are provided).  The purpose is to remove prompting