Update news

1 files changed, 11 insertions, 0 deletions

diff --git a/news.rst b/news.rst
index 2d7838f01..c7cc060ad 100644
--- a/news.rst
+++ b/news.rst
@@ -15,6 +15,17 @@ Version 2.18.1, Not Yet Released
   which uses thousands separators (pt_BR was reported as having
   this issue). (GH #2732 #2730 #2237)
 
+* DNS names in name constraints were compared with case sensitivity, which
+  could cause valid certificates to be rejected. (GH #2739 #2735)
+
+* X.509 name constraint extensions were rejected if non-critical. RFC 5280
+  requires conforming CAs issue such extensions as critical, but not all
+  certificates are compliant, and all other known implementations do not
+  require this. (GH #2739 #2736)
+
+* X.509 name constraints were incorrectly applied to the certificate which
+  included the constraint. (GH #2739 #2737)
+
 Version 2.18.0, 2021-04-15
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^