1 files changed, 5 insertions, 0 deletions
diff --git a/CHANGELOG b/CHANGELOG
index 16f758c3a..cc999c1e8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,8 @@
+    Certificates now always specify a subjectAltName, but it defaults
+    to '*', meaning that it doesn't require DNS names to match.  You
+    can override that behaviour by specifying a value for
+    'certdnsnames', which will then require that hostname as a match (#896).
+
     Relationship metaparams (:notify, :require, :subscribe, and
     :before) now stack when they are collecting metaparam values
     from their containers (#446).  For instance, if a resource