diff --git a/ChangeLog.d/x509-empty-authority-key-id.txt b/ChangeLog.d/x509-empty-authority-key-id.txt
new file mode 100644
index 0000000000..a3c5d99096
--- /dev/null
+++ b/ChangeLog.d/x509-empty-authority-key-id.txt
@@ -0,0 +1,7 @@
+Bugfix
+   * Accept X.509 certificates whose AuthorityKeyIdentifier extension is an
+     empty SEQUENCE. All of its fields are optional, so such certificates
+     are syntactically valid, but they were rejected with
+     MBEDTLS_ERR_X509_INVALID_EXTENSIONS. This affected, for example, the
+     root certificate that some antivirus products install for HTTPS
+     scanning. Reported by CodingMarkus. Fixes #10253.