Skip to content

v2.197

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Jul 22:27
· 515 commits to main since this release
v2.197
4d7bb71

What's Changed

Added

  • Named protocol URLs can be enabled on existing CAs — the opt-in previously available only at CA creation can now be enabled afterwards from the CRL & OCSP page (or PATCH /api/v2/cas/<id> with namedUrls). Auto-generated CDP/AIA URLs are rewritten to the slug form and newly issued certificates embed it; already-issued certificates keep their refid URLs, which continue to resolve. Enabling remains irreversible. (#207)

Fixed

  • ACME proxy Link: rel="up" header — the authorization link returned on challenge responses doubled the /acme/proxy path segment, sending clients that re-poll their authorization (Traefik/lego) to a nonexistent URL. (#217)
  • ACME proxy certificate download latency — DNS-01 TXT cleanup now runs in a background thread instead of blocking the certificate response on live DNS-provider API calls. (#218)
  • ACME proxy order lookup on certificate download — the upstream certificate URL is now persisted on the proxy order when it first appears (finalize or order poll), so the download resolves its order with one indexed query instead of a live upstream round-trip per accumulated pending order. (#219)
  • ACME proxy no longer forwards the upstream Link header — its rel="alternate" entries point directly at the real CA and cannot be authenticated by proxy clients; the preferred chain is already resolved server-side and served in the body. (#220)
  • CRL & OCSP details panel layout — the "Full CRL Schedule" and "Delta CRL" blocks now render as framed sections, consistent with the rest of the panel.
📜 Recent release history (last 2 versions)

[2.196] - 2026-07-18

Added

  • ACME loopback upstream opt-in — a new toggle (Let's Encrypt settings / acme.client.allow_loopback_upstream, default off) allows the ACME client and proxy to reach an upstream CA on a loopback address (a colocated Pebble/step-ca on 127.0.0.1). Cloud-metadata targets remain blocked unconditionally.

Fixed

  • Security-key (WebAuthn) login restored — after the per-user credential count was removed from /auth/methods (username-enumeration hardening), the login page stopped offering the security-key option and auto-attempt. The UI no longer depends on that count: it auto-attempts based on the device's saved method and always offers the security-key button when the browser supports it.
  • WebAuthn username-enumeration oracle closed — POST /auth/login/webauthn/start returned a challenge only for users with a registered key (200) versus a 401 otherwise, and /verify used distinguishable errors. Both now return identical, well-formed responses for unknown, credential-less, and real users (a deterministic per-username decoy credential), removing the account-existence oracle.
  • No default serverAuth EKU on issuing CAs — intermediate CAs created via the API without an explicit extendedKeyUsage were given a serverAuth EKU, which (via EKU chaining) invalidated clientAuth / emailProtection / OCSPSigning leafs issued beneath them, including delegated OCSP responders. Issuing CAs now have no EKU by default; constrain them explicitly via extendedKeyUsage.
  • ACME proxy serves the preferred certificate chain — the per-account preferred chain was computed and stored but the upstream default chain was returned to the client; the selected chain is now the one delivered.
  • ACME proxy order ownership binding — new-order and finalize now bind an order to the account resolved from the request kid, so a different account can no longer finalize someone else's order. The previous binding only took effect for JWK-signed requests, which RFC 8555 new-order/finalize never are.
  • ACME DNS-01 self-check is advisory — a local resolver that cannot see the challenge TXT record (split-horizon or filtered egress DNS) no longer aborts renewal or proxy issuance before the challenge is submitted; the CA remains the authority. Set the propagation timeout to 0 to skip the pre-check entirely.
  • SAN URI validation — the issuance/CSR forms now accept authority-less URIs (urn:, mailto:, did:), matching what the API already allowed.
  • Account page PKCS#12 labels — two missing translation keys rendered as raw identifiers on the mTLS certificate export controls.
  • Signed CSR history panel — clicking "View certificate" no longer throws a runtime error.
  • ACME auto-renewal toggle persistence — the Let's Encrypt auto-renewal switch sent a field the API did not read, so the setting never saved; it now uses renewal_enabled.

Translations

  • Completed the ACME "verbose logs" label and description across all locales.

[2.195] - 2026-07-18

Added

  • Named protocol URLs per CA (opt-in) — a CA created with namedUrls gets an immutable unique slug derived from its name, used instead of the random id in CDP/AIA URL paths (/cdp/my-issuing-ca.crl); both slug and refid forms always resolve. Easier manual configuration of CRL/OCSP paths in relying products; refid stays the default. Migration 060. (#207)
  • Full CRL schedule per CA — CRL validity (nextUpdate window) decoupled from the publish cadence, with next_publish exposed in CRL metadata and the scheduler republishing on the configured interval; configurable CRL signature digest (SHA-256/384/512). New GET|POST /api/v2/crl/<ca_id>/config, CRL & OCSP page UI, migration 059. (#207)
  • Readable CRL download filename — CDP downloads suggest {ca-slug}-{refid8}.crl via Content-Disposition; URLs are unchanged (they are embedded in issued certificates). (#207)
  • Clock-skew tolerance on issuance — issued certificates backdate notBefore by a fixed 15 minutes so relying parties with slightly slow clocks accept fresh certificates; notAfter stays anchored on the requested validity. (#207)
  • Port 80 for protocol endpoints — documented the supported ways to serve CDP/OCSP/AIA on port 80 (systemd CAP_NET_BIND_SERVICE, reverse proxy, Docker port mapping). (#207)

Fixed

  • Template digest honored at issuance — certificates issued from the certificate menu were always signed SHA-256 regardless of the template's configured digest; the template link (template_id) is now persisted on the issued row. (#207)
  • Template usage counter — the templates list/detail now return a live usage_count computed from issued certificates (the UI previously displayed a field the API never provided). (#207)

Full history: CHANGELOG.md

Installation

Docker (Recommended)

# From Docker Hub
docker pull neyslim/ultimate-ca-manager:2.197

# Or from GitHub Container Registry
docker pull ghcr.io/neyslim/ultimate-ca-manager:2.197

# Run
docker run -d -p 8443:8443 \
  -e SECRET_KEY=$(openssl rand -hex 32) \
  --name ucm neyslim/ultimate-ca-manager:2.197

Debian/Ubuntu

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.197/ucm_2.197_all.deb
sudo dpkg -i ucm_2.197_all.deb
sudo apt-get install -f

Fedora/RHEL

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.197/ucm-2.197-1.fc43.noarch.rpm
sudo dnf install ./ucm-2.197-1.fc43.noarch.rpm

Silent/Automated Install

# Skip firewall prompts for CI/automation
sudo UCM_PORT=8443 UCM_FIREWALL=no dpkg -i ucm_2.197_all.deb

Default Credentials

  • Username: admin
  • Password: changeme123

Change the password immediately after first login!

Documentation

Assets 5
Loading