From dfc836c346cc6001534eaf9ed3a151b7aa658335 Mon Sep 17 00:00:00 2001
From: Markus Minichmayr <markus@tapkey.com>
Date: Wed, 22 Nov 2023 17:43:27 +0100
Subject: PreferNoDHEKEX changelog and history anticipating inclusion in
 OpenSSL version 3.3.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22794)
---
 CHANGES.md                | 6 ++++++
 doc/man3/SSL_CONF_cmd.pod | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/CHANGES.md b/CHANGES.md
index 81044b3d70..93365619fa 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -45,6 +45,12 @@ OpenSSL 3.3
 
    *Ahelenia Ziemiańska*
 
+ * New option `SSL_OP_PREFER_NO_DHE_KEX`, which allows configuring a TLS1.3
+   server to prefer session resumption using PSK-only key exchange over PSK
+   with DHE, if both are available.
+
+   *Markus Minichmayr, Tapkey GmbH*
+
 OpenSSL 3.2
 -----------
 
diff --git a/doc/man3/SSL_CONF_cmd.pod b/doc/man3/SSL_CONF_cmd.pod
index a0e4d52892..54ab886af1 100644
--- a/doc/man3/SSL_CONF_cmd.pod
+++ b/doc/man3/SSL_CONF_cmd.pod
@@ -789,6 +789,8 @@ OpenSSL 3.0.
 The B<TxCertificateCompression> and B<RxCertificateCompression> options were
 added in OpenSSL 3.2.
 
+B<PreferNoDHEKEX> was added in OpenSSL 3.3.
+
 =head1 COPYRIGHT
 
 Copyright 2012-2023 The OpenSSL Project Authors. All Rights Reserved.
-- 
cgit v1.2.3