diff --git a/ChangeLog b/ChangeLog
index 8d7a810..ab1b78b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,9 @@
 = mbed TLS 1.3 branch
 
 Security
+   * With authmode set to SSL_VERIFY_OPTIONAL, verification of keyUsage and
+     extendedKeyUsage on the leaf certificate was lost (results not accessible
+     via ssl_get_verify_results()).
 
 Features
    * Add x509_crt_verify_info() to display certificate verification results.