diff --git a/ChangeLog b/ChangeLog
index 2ecbcc0fd..80dda042e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,13 @@ Bugfix
    * Correct extraction of signature-type from PK instance in X.509 CRT and CSR
      writing routines that prevented these functions to work with alternative
      RSA implementations. Raised by J.B. in the Mbed TLS forum. Fixes #1011.
+   * Don't print X.509 version tag for v1 CRT's, and omit extensions for
+     non-v3 CRT's.
+
+Changes
+   * Extend cert_write example program by options to set the CRT version
+     and the message digest. Further, allow enabling/disabling of authority
+     identifier, subject identifier and basic constraints extensions.
 
 = mbed TLS 2.1.9 branch released 2017-08-10