v0,28,2

CHANGELOG.md

@@ -4,6 +4,15 @@
 > test-only changes and packaging implementation notes were moved to
 > [`docs/CHANGELOG_TECHNICAL_ARCHIVE.md`](docs/CHANGELOG_TECHNICAL_ARCHIVE.md).
 
+## 0.28.2
+
+- Harden external certificate-file loading for Certbot/system-managed PEMs without requiring an exact chmod. POSIX ACL read access and group-readable private keys are supported; private keys still reject world-read and all external certificate/key files reject group/world-write.
+- Validate the configured external path and the resolved Certbot target through root/RustProxy-owned non-writable parent directories, while allowing root-owned sticky ancestors such as `/tmp`.
+- Make Certificate API credentials least-privilege: new tokens are reload-only by default, require an explicit certificate-ID allowlist, cannot call global reload, and need an explicit opt-in for deploy permission. Existing credentials migrate to reload-only broad access until rotated.
+- Add SQLite schema 9 for per-token Certificate API grants; the saved proxy configuration and COLD cache format remain unchanged.
+- Add explicit read-only systemd access declarations for `/etc/letsencrypt` and `/etc/ssl` and document POSIX ACL setup, including directory traversal-only grants.
+- Improve English/Polish certificate UI help so external file ownership, ACL, parent-directory and reload-token requirements are visible where the paths/tokens are configured.
+
 ## 0.28.1
 
 - Add manual certificate support for absolute external certificate/key paths, including `/etc/letsencrypt/live/...` pairs. Certbot-style symlinks are resolved again on every reload so an external renewal can be hot-published without copying files into RustProxy storage.