diff --git a/ChangeLog b/ChangeLog
index 764e447..108d483 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -54,6 +54,9 @@
    * Extend the MBEDTLS_SSL_EXPORT_KEYS to export the handshake randbytes,
      and the used tls-prf.
    * Add public API for tls-prf function, according to requested enum.
+   * Add DER-encoded test CRTs to library/certs.c, allowing
+     the example programs ssl_server2 and ssl_client2 to be run
+     if MBEDTLS_FS_IO and MBEDTLS_PEM_PARSE_C are unset. Fixes #2254.
 
 Changes
    * Server's RSA certificate in certs.c was SHA-1 signed. In the default