diff --git a/changelog/15996.txt b/changelog/15996.txt
new file mode 100644
index 000000000000..b29f1da19fae
--- /dev/null
+++ b/changelog/15996.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secret/pki: Allow issuing certificates with non-domain, non-email Common Names from roles, sign-verbatim, and as issuers (`cn_validations`).
+```