changelog++

CHANGELOG.md

@@ -14,6 +14,8 @@ IMPROVEMENTS:
  * command/rekey and command/generate-root: These now return the status at
    attempt initialization time, rather than requiring a separate fetch for the
    nonce [GH-1054] 
+ * credential/cert: Don't require root/sudo tokens for the `certs/` and `crls/`
+   paths; use normal ACL behavior instead [GH-468]
  * secret/ssh: When verifying an OTP, return 400 if it is not valid instead of
    204 [GH-1086]
  * secret/github: Github backend will check the validity of original token