+3
c9803c2a8f
c9803c2a8f
**Related issue:** Resolves #44348 **Base branch:** `docs-v4.86.0` (not `main`) per the docs release process. ## What this PR does Updates four customer-facing guides and adds a release-notes entry for Phase 2's opt-in cert renewal feature (shipped via #45696). Frames the marker as an opt-in enhancement: profiles without it continue to work as in 4.85; profiles with it activate auto-renewal. | Guide | Change | |-------|--------| | `connect-end-user-to-wifi-with-certificate.md` | Migrated 11 legacy `\$FLEET_VAR_SCEP_RENEWAL_ID` refs to the preferred name; added back-compat callout. | | `okta-conditional-access-integration.md` | Removed "Automatic renewal coming soon" line; added one-time upgrade-redeploy callout for existing customers. | | `enable-okta-verify-on-macOS-with-configuration-profile.md` | Added marker to example profile OU; added opt-in note and CA-side OU-preservation verification step. Coordinated with the earlier example-profile update from #43293 already on `docs-v4.86.0`. | | `enable-okta-verify-on-windows-using-a-scep-configuration-profile.md` | Replaced manual-redeployment narrative with auto-renewal guidance. Kept the policy-based expiry-monitoring SQL as an optional safeguard. | Release-notes entry (`changes/40639-non-proxied-cert-renewal`) consolidates Phase 2 customer-visible behavior in three bullets. ## Dependencies The Conditional Access guide's "new setups: no extra action needed" framing assumes #45662 (the Fleet-side template marker addition) has landed — it has, merged into the feature branch and onward into main via #45696. # Checklist for submitter - [x] Changes file added for user-visible changes ## Testing - [x] Doc review only — no code changes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Automatic certificate renewal is now supported for SCEP and ACME certificates from external certificate authorities, enabled by default for new deployments with an opt-in path for existing customers * macOS devices with ACME-bearing configuration profiles will now surface hardware-bound certificates in device vitals <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Rachael Shaw <r@rachael.wtf> Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> Co-authored-by: kilo-code-bot[bot] <240665456+kilo-code-bot[bot]@users.noreply.github.com> Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> Co-authored-by: melpike <79950145+melpike@users.noreply.github.com> Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com> Co-authored-by: Jonathan Katz <44128041+jkatz01@users.noreply.github.com> Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com> Co-authored-by: Magnus Jensen <magnus@fleetdm.com> Co-authored-by: RachelElysia <71795832+RachelElysia@users.noreply.github.com> Co-authored-by: Scott Gress <scottmgress@gmail.com>
4 lines
502 B
Plaintext
4 lines
502 B
Plaintext
* Added automatic renewal for SCEP and ACME certificates issued by external certificate authorities (Okta Conditional Access, Okta Verify, Hydrant ACME). Add `$FLEET_VAR_CERTIFICATE_RENEWAL_ID` to the certificate's Subject OU to enable.
|
|
* Renamed `$FLEET_VAR_SCEP_RENEWAL_ID` to `$FLEET_VAR_CERTIFICATE_RENEWAL_ID`. The legacy name still works.
|
|
* Enabled automatic renewal by default in Fleet's generated Conditional Access profile. Existing customers can opt in by redeploying the User scope profile.
|