Skip to content

docs: weekly documentation audit 2026-06-23 #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
krakenhavoc wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

docs: weekly documentation audit 2026-06-23 #16

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,16 @@ Notable changes to the KrakenKey cert-action. Format follows [Keep a Changelog](

## [Unreleased]

### Changed
- **Release Pipeline**: release trigger restricted to `v[0-9]+.[0-9]+.[0-9]+` tags only; major-version pointer tags (e.g. `v1`) no longer retrigger the workflow. Structured release notes auto-generated from CHANGELOG using `.github/release.yaml` label categories. Each release marked `latest` via `make_latest: true`.

### PKI Advisories

- **SC-098v2 — CAA RFC 8657 Parameters**: CA/B Forum ballot SC-098v2 (passed 2026-05-13) makes RFC 8657 `validationmethods` and `accounturi` CAA record parameters mandatory for all public CAs by **March 2027**. This action issues certificates via Let's Encrypt ACME DNS-01. If a user's CAA record sets `validationmethods`, it must include `dns-01`. No configuration change required today.
- **Chrome EKU Separation — enforced 2026-06-15**: TLS intermediates must be `serverAuth`-only (no `clientAuth`). Let's Encrypt intermediates (used by this action) are already compliant. Users issuing via DigiCert or Sectigo should re-issue affected certificates.
- **CT Mandatory Logging — enforced 2026-06-15**: Chrome Root Program Policy v1.8 §1.3.4.1 requires precertificate CT logging before issuance. DigiCert removed opt-out settings 2026-06-01. Let's Encrypt always CT-logs; no action required for users of this action.
- **LE Merkle Tree Certificates — announced 2026-06-03**: Let's Encrypt announced that Merkle Tree Certificates (MTC) are their planned post-quantum issuance path. Staging: late 2026; production: 2027. MTC does not use the traditional `chain.pem` / `fullchain.pem` model. **This action will require updates before the production rollout.**

---

## [v1.1.0] — 2026-05-18
Expand Down
Loading