diff --git a/CHANGELOG.md b/CHANGELOG.md
index d2d3f67..1306c90 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - Configuration key `lastErrorKey` for reporting errors to host app. [#40](https://github.com/keeshux/tunnelkit/pull/40)
+- Server extended key usage validation (EKU). [#27](https://github.com/keeshux/tunnelkit/issues/27)
 
 ### Fixed
 
diff --git a/README.md b/README.md
index 3cb1b52..a80c933 100644
--- a/README.md
+++ b/README.md
@@ -23,7 +23,7 @@ The client is known to work with [OpenVPN®][openvpn] 2.3+ servers. Key renegoti
 - [x] NCP (Negotiable Crypto Parameters, 2.4)
     - Server-side
 - [x] TLS handshake
-    - CA validation
+    - Server validation (CA, EKU)
     - Client certificate
 - [x] TLS wrapping
     - Authentication (`--tls-auth`)