Zaita - What's New/¶

What's happening in the world of Zaita?

2026.10.16 - Multi-CA Uplifts, Non-Domain Name Certs¶

Added more compatibility for non-domain name certificates to support things like SPIFFE/SPIRE
The Local PKI Certificate Authority is now user-added based on Root Certificates
Can Disable/Enable Root and Intermediate Certificates
New Policy to block non-domain name certificate issuances
Policies can now be scoped to one or more CAs, or all
Users need the new "Allow non-domain certificate issuance" setting (Admin -> Users) to request non-domain names
Existing Local PKI setups were migrated automatically to one Local PKI Certificate Authority per Root Certificate
ACME-WIF: the reason a wif-01 challenge failed is now recorded in the audit log to help with troubleshooting

When adding an ADCS Certificate Authority integration, you now can select between "Simple" and "Advanced" modes to make it easier.
Notifications from testing Certificate Authority integrations will now pop up on the browser.
Fixed some minor issues with Let's Encrypt

ACME-WIF provides OpenID Connect JWT based authentication for ACMEv2 (RFC8555) based on new proposal
New Bridge release

Domains can now be validated using DNS TXT records to verify control
Validated public domains can now use ACME-DNS (CNAME Delegation) for Let's Encrypt
Let's Encrypt now added as supported Certificate Authority using CNAME Delegation
All Domains now have a default Certificate Authority issued
Couriers now authenticate with your tenant's UUID (api.tenant_uuid) instead of a per-Courier UUID, so one configuration template works for all Couriers
New Bridge and Courier releases