diff --git a/ChangeLog b/ChangeLog
index d4cf85b..20c8eaf 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,14 @@
 mbed TLS ChangeLog (Sorted per branch, date)
 
+= mbed TLS x.x.x branch released xxxx-xx-xx
+
+Bugfix
+   * Fix output certificate verification flags set by x509_crt_verify_top() when
+     traversing a chain of trusted CA. The issue would cause both flags,
+     BADCERT_NOT_TRUSTED and BADCERT_EXPIRED, to be set when the verification
+     conditions are not met regardless of the cause. Found by Harm Verhagen and
+     inestlerode. #665 #561
+
 = mbed TLS 1.3.18 branch 2016-10-17
 
 Security