From 16bd0ff4c6326c70580b482d11e6a53bf74eaa6e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christopher=20M=C3=BCller?= <chris@mechatronikmonkey.de>
Date: Sat, 26 Sep 2026 10:27:11 +0200
Subject: [PATCH] Add ChangeLog entry for empty AuthorityKeyIdentifier
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Christopher Müller <chris@mechatronikmonkey.de>
---
 ChangeLog.d/x509-empty-authority-key-id.txt | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 ChangeLog.d/x509-empty-authority-key-id.txt

diff --git a/ChangeLog.d/x509-empty-authority-key-id.txt b/ChangeLog.d/x509-empty-authority-key-id.txt
new file mode 100644
index 0000000000..a3c5d99096
--- /dev/null
+++ b/ChangeLog.d/x509-empty-authority-key-id.txt
@@ -0,0 +1,7 @@
+Bugfix
+   * Accept X.509 certificates whose AuthorityKeyIdentifier extension is an
+     empty SEQUENCE. All of its fields are optional, so such certificates
+     are syntactically valid, but they were rejected with
+     MBEDTLS_ERR_X509_INVALID_EXTENSIONS. This affected, for example, the
+     root certificate that some antivirus products install for HTTPS
+     scanning. Reported by CodingMarkus. Fixes #10253.