Don't build RC4 ciphersuites into libssl by default

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 618655816f94bd154a40ee0c0e381ceb17d008c8..f534cf7aaab0daec80c1bfacc4d716ba362f1060 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,11 @@
 
  Changes between 1.0.2g and 1.1.0  [xx XXX xxxx]
 
+  *) RC4 based libssl ciphersuites are now classed as "weak" ciphers and are
+     disabled by default. They can be re-enabled using the
+     enable-weak-ssl-ciphers option to Configure.
+     [Matt Caswell]
+
   *) If the server has ALPN configured, but supports no protocols that the
      client advertises, send a fatal "no_application_protocol" alert.
      This behaviour is SHALL in RFC 7301, though it isn't universally