X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=CHANGES;h=6f780077b11400957461d29e3a0e7b35e3ec0c44;hp=943080944c1cad8e88044f83ca05af80d19497d6;hb=8c149cfd834748c8ee9cca4cd5b336c1829245a2;hpb=1b9a59c36a547443dbefb0faed6598b3a15719c9

diff --git a/CHANGES b/CHANGES
index 943080944c..6f780077b1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -174,12 +174,12 @@
   *) Fix OCSP checking.
      [Rob Stradling <rob.stradling@comodo.com> and Ben Laurie]
 
-  *) Backport support for partial chain verification: if an intermediate
-     certificate is explicitly trusted (using -addtrust option to x509
-     utility for example) the verification is sucessful even if the chain
-     is not complete.
-     The OCSP checking fix depends on this backport.
-     [Steve Henson and Rob Stradling <rob.stradling@comodo.com>]
+  *) Initial experimental support for explicitly trusted non-root CAs. 
+     OpenSSL still tries to build a complete chain to a root but if an
+     intermediate CA has a trust setting included that is used. The first
+     setting is used: whether to trust (e.g., -addtrust option to the x509
+     utility) or reject.
+     [Steve Henson]
 
   *) Add -trusted_first option which attempts to find certificates in the
      trusted store even if an untrusted chain is also supplied.