1.39.2 — Shared DNS validation through the existing Admin

2026-10-21

Sites and trusted projects can share DNS validation while issuing their own certificates and keeping their private keys, using the existing Admin login and normal deployment controls.

Added

• Packaged Admin controls for shared-validation credentials, trust approval and one-time hub enablement using the current login and fresh authentication.

Changed

• Hub enablement checks the latest converged fleet deployment. The separate root enrollment and attestation workflow is removed.

Fixed

• Existing owners and already trusted participants can continue renewing before sharing is enabled.

Upgrade notes

• Deploy 1.39.2 to every expected node, verify the deployment, then select Enable shared validation in Admin.
• Run normal forward migrations. Existing certificate material and installation columns remain available during rolling upgrades.
• The 1.39.1 migration-lock fix is retained. After sharing is enabled, ordinary deployment checks refuse a framework below the recorded minimum.