Commit 44847ff10c for openssl.org

commit 44847ff10c5101965f9f8b1eaea4ad50658e8eb9
Author: Eugene Syromiatnikov <esyr@openssl.org>
Date:   Thu Oct 8 16:56:45 2026 +0200

    Fix up OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR history documentation

    The OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR has been actually added
    in commit 7960dbec6801 "    Certificate Management Protocol (CMP,
    RFC 4210) extension to OpenSSL     Also includes CRMF (RFC 4211)
    and HTTP transfer (RFC 6712)", commit e7d5206e892e "apps/cmp.c: add
    -ta_in_ip_extracerts permitting non-authenticated trust anchors in IP
    extracerts according to 3GPP TS 33.310" has only wired up in the openssl
    command;  correct the HISTORY section in doc/man3/OSSL_CMP_CTX_new.pod
    and the entry in CHANGES.md accordingly.

    Fixes: cdad6573efed "add HISTORY and CHANGES.md entry for OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR introduced in 4.0"
    Reported-by: Tomas Mraz <tomas@openssl.foundation>
    Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
    Merge-date: Sat Oct 10 15:57:15 2026
    Merged-from: https://github.com/openssl/openssl/pull/33167

diff --git a/CHANGES.md b/CHANGES.md
index b974e4a71b..04d35941a6 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1750,8 +1750,9 @@ OpenSSL 4.0

    *Bob Beck*

- * Added `OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR` option for `OSSL_CMP_CTX`
-   and a corresponding `-ta_in_ip_extracert` option for the `openssl cmp` command.
+ * Added a `-ta_in_ip_extracert` option for the `openssl cmp` command, that sets
+   `OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR` option for the `OSSL_CMP_CTX`
+   object.

    This work was sponsored by Siemens AG.

diff --git a/doc/man3/OSSL_CMP_CTX_new.pod b/doc/man3/OSSL_CMP_CTX_new.pod
index 2c4cabca69..f33e282794 100644
--- a/doc/man3/OSSL_CMP_CTX_new.pod
+++ b/doc/man3/OSSL_CMP_CTX_new.pod
@@ -900,9 +900,6 @@ OSSL_CMP_CTX_get0_geninfo_ITAVs() were added in OpenSSL 3.3.
 Support for central key generation, requested via B<OSSL_CRMF_POPO_NONE>,
 was added in OpenSSL 3.5.

-
-The B<OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR> option was added in OpenSSL 4.0.
-
 The B<OSSL_CMP_OPT_NONMATCHED_ERROR_NONCES> option was added in OpenSSL 4.1.

 =head1 COPYRIGHT