generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

DANE CHANGES

Browse Source 
Reviewed-by: Richard Levitte <levitte@openssl.org>
This commit is contained in:
Viktor Dukhovni 2016-01-07 22:00:14 -05:00
parent 60d8edbc09
commit 59fd40d4e5
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
CHANGES
View File

@ -4,6 +4,20 @@
Changes between 1.0.2e and 1.1.0 [xx XXX xxxx]
*) Support for RFC6698/RFC7671 DANE TLSA peer authentication.
Obtaining and performing DNSSEC validation of TLSA records is
the application's responsibility. The application provides
the TLSA records of its choice to OpenSSL, and these are then
used to authenticate the peer.
The TLSA records need not even come from DNS. They can, for
example, be used to implement local end-entity certificate or
trust-anchor "pinning", where the "pin" data takes the form
of TLSA records, which can augment or replace verification
based on the usual WebPKI public certification authorities.
[Viktor Dukhovni]
*) Revert default OPENSSL_NO_DEPRECATED setting. Instead OpenSSL
continues to support deprecated interfaces in default builds.
However, applications are strongly advised to compile their

1
NEWS
View File

@ -28,6 +28,7 @@
argument, or via the "--api=1.1.0|1.0.0|0.9.8" option.
o Application software can be compiled with -DOPENSSL_API_COMPAT=version
to ensure that features deprecated before that version are not exposed.
o Support for RFC6698/RFC7671 DANE TLSA peer authentication
Major changes between OpenSSL 1.0.2d and OpenSSL 1.0.2e [3 Dec 2015]