Skip to content

docs: weekly documentation audit 2026-06-16 #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
krakenhavoc wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

docs: weekly documentation audit 2026-06-16 #15

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,38 @@ Notable changes to the KrakenKey cert-action. Format follows [Keep a Changelog](

## [Unreleased]

### Release Pipeline

- Release workflow restricted to semver tags only (`v[0-9]+.[0-9]+.[0-9]+`); major-version pointer tags (e.g. `v1`) no longer re-trigger the pipeline.
- Structured release notes auto-generated via `.github/release.yaml` label categories (Features, Bug Fixes, Other Changes).
- Each release marked as latest via `make_latest: true`.

### PKI Advisory — SC-098v2 (CAA RFC 8657)

CA/B Forum ballot SC-098v2 passed 2026-05-13. All public CAs must enforce RFC 8657 CAA `accounturi` and `validationmethods` parameter extensions by **March 2027**.

This action issues certificates via Let's Encrypt using ACME DNS-01. If your domain's CAA record sets `validationmethods`, it must include `dns-01` for certificate issuance to continue after the enforcement deadline. CAA records without these parameters are unaffected.

### PKI Advisory — Chrome EKU Separation

**Enforced 2026-06-15.** TLS server intermediates may no longer carry `clientAuth` EKU alongside `serverAuth`. DigiCert and Sectigo retired multi-purpose intermediates. Let's Encrypt E5/E6/R10/R11 intermediates were already `serverAuth`-only — this action is not impacted.

### PKI Advisory — CT Mandatory Logging

**Enforced 2026-06-15** (Chrome Root Program Policy v1.8 §1.3.4.1). DigiCert removed CT opt-out settings from CertCentral on 2026-06-01. Let's Encrypt has always logged all certificates to public CT logs; this action is fully compliant.

Note: internal hostnames on publicly-trusted certificates are permanently visible in public CT logs. If your workflows issue certificates for internal hostnames on public CAs, those hostnames are in CT log history with no opt-out path.

### PKI Advisory — Let's Encrypt Merkle Tree Certificates (Post-Quantum Path)

Let's Encrypt announced on **2026-06-03** that their post-quantum issuance path will use Merkle Tree Certificates (MTC), not ML-DSA X.509 (RFC 9881). MTC uses Merkle inclusion proofs instead of a certificate chain; staging is planned for late 2026, production for 2027.

The `chain-path` and `fullchain-path` inputs and outputs of this action apply to the current X.509 chain model. They will not apply to MTC-issued certificates once that path goes live. No action is needed now; monitor [letsencrypt.org](https://letsencrypt.org) for the MTC timeline.

### Suggested next release

**v1.2.0** — minor: new release-pipeline behaviour documented above.

---

## [v1.1.0] — 2026-05-18
Expand Down
Loading