Commit 19fbbd80b5 for openssl.org
commit 19fbbd80b5cd4a503afab8004fcca8f4a76d230f
Author: Eugene Syromiatnikov <esyr@openssl.org>
Date: Mon Aug 24 07:17:05 2026 +0200
CHANGES.md: rephrase TLS 1.3 ticket lifetime cap change log record
Complements: 21c92ae589af "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Merge-date: Fri Aug 28 11:16:07 2026
Merged-from: https://github.com/openssl/openssl/pull/32484
diff --git a/CHANGES.md b/CHANGES.md
index 5dba262e2e..36b16e367b 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -421,15 +421,11 @@ OpenSSL 4.0
### Changes between 4.0.1 and 4.0.2 [xx XXX XXXX]
- * Add client-side validation for TLS 1.3 session ticket lifetimes.
-
- In accordance with [RFC 8446 Section 4.6.1](https://datatracker.ietf.org/doc/html/rfc8446#section-4.6.1),
- TLS 1.3 clients must not cache session tickets
- for longer than 7 days (604800 seconds).
- When processing a new session ticket message with a
- `ticket_lifetime_hint` value greater than 7 days,
- the client now caps the lifetime to the
- maximum permitted value of 7 days (604800 seconds).
+ * Updated compliance with TLS 1.3 session ticket lifetime requirements.
+ TLS 1.3 clients now cap `ticket_lifetime_hint` to 7 days (604800 seconds)
+ when processing new session ticket messages, in accordance
+ with [RFC 8446 Section 4.6.1].
+ <!-- https://github.com/openssl/openssl/pull/31174 -->
*Abel Thomas*
@@ -23744,6 +23740,7 @@ ndif
[RFC 7919]: https://datatracker.ietf.org/doc/html/rfc7919
[RFC 8422]: https://datatracker.ietf.org/doc/html/rfc8422
[RFC 8446]: https://datatracker.ietf.org/doc/html/rfc8446
+[RFC 8446 Section 4.6.1]: https://datatracker.ietf.org/doc/html/rfc8446#section-4.6.1
[RFC 8452]: https://datatracker.ietf.org/doc/html/rfc8452
[RFC 8998]: https://datatracker.ietf.org/doc/html/rfc8998#name-iana-considerations
[RFC 9149]: https://datatracker.ietf.org/doc/html/rfc9149