diff --git a/ChangeLog b/ChangeLog
index f008cdc..354fcab 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -29,6 +29,9 @@
    * Certificate verification functions now set flags to -1 in case the full
      chain was not verified due to an internal error (including in the verify
      callback) or chain length limitations.
+   * With authmode set to optional, handshake is now aborted if the
+     verification of the peer's certificate failed due to an overlong chain or
+     a fatal error in the vrfy callback.
 
 = mbed TLS 1.3.20 released 2017-06-21