Reject certs and CRLs from the future

ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 6995003..9ce5b83 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -18,6 +18,7 @@
    * Forbid change of server certificate during renegotiation to prevent
      "triple handshake" attack when authentication mode is optional (the
      attack was already impossible when authentication is required).
+   * Check notBefore timestamp of certificates and CRLs from the future.
 
 Bugfix
    * ecp_gen_keypair() does more tries to prevent failure because of