Changelog - Certplane

2026-05-22

httpreq DNS provider for Let’s Encrypt DNS-01. Solve DNS-01 challenges against any DNS API that speaks the lego httpreq protocol — useful for in-house or otherwise unsupported DNS providers. Configure it on a broker issuer and reference it from a policy profile. See the Let’s Encrypt DNS guide.

Custom recursive nameservers for httpreq. The httpreq provider now accepts a recursive_nameservers option so propagation checks can be pointed at the resolvers you actually want to query, instead of the system defaults.
DNS-01 credentials are no longer mandatory. Providers that don’t need API credentials (for example, an internal httpreq endpoint protected at the network layer) can be configured without supplying secrets. See the broker configuration reference.

Rewritten end-to-end against the current code. All CLI examples now use the actual flag layout (-c <config> <subcommand>) for both certplane-broker (serve / policy validate / certs list / audit tail) and certplane-agent (enroll / run / check).
JSON Schemas are now linked everywhere. broker.schema.json, agent.schema.json, and policy.schema.json drive every configuration reference page.
New: Ansible roles guide. Covers the certplane_broker and certplane_agent roles shipped under ansible/. Variable references, what each role does, and how enrollment stays idempotent.
Refreshed example configs to match examples/config/ in the source tree.
Dark mode CSS fix. The active sidebar nav entry is now legible in dark mode — previously it sat at the same luminance as the page background.