diff --git a/ChangeLog.d/rm-ticket-lifetime-option b/ChangeLog.d/rm-ticket-lifetime-option
new file mode 100644
index 000000000..4851512f8
--- /dev/null
+++ b/ChangeLog.d/rm-ticket-lifetime-option
@@ -0,0 +1,5 @@
+Removals
+   * Remove the MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES
+     compile-time option. This option has been inactive for a long time.
+     Please use the `lifetime` parameter of `mbedtls_ssl_ticket_setup()`
+     instead.