From 8cf549d0479402d349081687b3bd347a1236cede Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Fri, 13 Jan 2023 08:41:15 +0100
Subject: [PATCH] changelog: document the enforced check on x509 serial setting

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 .../improve_x509_cert_writing_serial_number_management.txt   | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 ChangeLog.d/improve_x509_cert_writing_serial_number_management.txt

diff --git a/ChangeLog.d/improve_x509_cert_writing_serial_number_management.txt b/ChangeLog.d/improve_x509_cert_writing_serial_number_management.txt
new file mode 100644
index 000000000..a85c79b70
--- /dev/null
+++ b/ChangeLog.d/improve_x509_cert_writing_serial_number_management.txt
@@ -0,0 +1,5 @@
+Bugfix
+   * mbedtls_x509write_crt_set_serial() now explicitly rejects serial numbers
+     whose binary representation is longer than 20 bytes. This was already
+     forbidden by the standard (RFC5280 - section 4.1.2.2) and now it's being
+     enforced also at code level.