Fix missing check for RSA key length on EE certs
- also adapt tests to use lesser requirement for compatibility with old
testing material
diff --git a/ChangeLog b/ChangeLog
index 5ba081c..d786dfa 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -9,6 +9,10 @@
ECHD-ECDSA if the only key exchange. Multiple reports. #310
* Fix bug causing some handshakes to fail due to some non-fatal alerts not
begin properly ignored. Found by mancha and Kasom Koht-arsa, #308
+ * mbedtls_x509_crt_verify(_with_profile)() now also checks the key type and
+ size/curve against the profile. Before that, there was no way to set a
+ minimum key size for end-entity certificates with RSA keys. Found by
+ Matthew Page.
Changes
* Improved performance of mbedtls_ecp_muladd() when one of the scalars is 1