anchor.diff:  [float]
   ==== 1.3.0
   
  -.new features
  -* <<pki,PKI Realm>>: Adds Public Key Infrastructure (PKI) authentication through the use of X.509 certificates in place of
  - username and password credentials.
  -* <<configuring-auditing, Index Output for Audit Events>>: An index based output has been added for storing audit events in an Elasticsearch index.
  -
  -.breaking changes
  +.Breaking Changes
   * The `sha2` and `apr1` hashing algorithms have been removed as options for the <<ref-cache-hash-algo,`cache.hash_algo` setting>>.
     If your existing Shield installation uses either of these options, remove the setting and use the default `ssha256`
     algorithm.
   * The `users` file now only supports `bcrypt` password hashing. All existing passwords stored using the `esusers` tool
     have been hashed with `bcrypt` and are not affected.
   
  -.enhancements
  +.New Features
  +* <<pki,PKI Realm>>: Adds Public Key Infrastructure (PKI) authentication through the use of X.509 certificates in place of
  + username and password credentials.
  +* <<configuring-auditing, Index Output for Audit Events>>: An index based output has been added for storing audit events in an Elasticsearch index.
  +
  +.Enhancements
   * TLS 1.2 is now the default protocol.
   * Clients that do not support pre-emptive basic authentication can now support both anonymous and authenticated access
     by specifying the `shield.authc.anonymous.authz_exception` <<anonymous-access,setting>> with a value of `false`.
   * Reduced logging for common SSL exceptions, such as a client closing the connection during a handshake.
   
  -.bug fixes
  +.Bug Fixes
   * The `esusers` and `syskeygen` tools now work correctly with environment variables in the RPM and DEB installation
     environment files `/etc/sysconfig/elasticsearch` and `/etc/default/elasticsearch`.
   * Default ciphers no longer include `TLS_DHE_RSA_WITH_AES_128_CBC_SHA`.
  
positive.code: === Change List
  
  [float]
  ==== 2.0.1
  
  .Breaking Changes
  
negative.code: of Shield will be added with a `.new` extension.
  
  [float]
  ==== Updated Role Definitions
  The default role definitions in the `roles.yml` file may need to be changed to ensure proper functionality with other
  applications such as Marvel and Kibana. Any role changes will be found in `roles.yml.new` after upgrading to the new
  version of Shield. We recommend copying the changes listed below to your `roles.yml` file.
  