v2.199

What's Changed

Added

• ACME proxy advertises Renewal Information (ARI, RFC 9773) — the proxy directory now exposes a renewalInfo endpoint served locally from the stored certificate, so ACME clients can schedule renewals of proxy-issued certificates. Imported certificates now populate AKI/SKI and serial number so their ARI certID resolves.
• Configurable trust store sync limit — the maximum number of certificates fetched per sync is now adjustable from the Trust Store page instead of being hardcoded.

Changed

• Generic external-CA metadata for ACME proxy certificates — certificates issued through the ACME proxy are stored with source acme_client and labelled with the external account name (e.g. Actalis, ZeroSSL) instead of the hardcoded "Let's Encrypt" identity. Proxy orders are pinned to their external CA account, and the ACME history view shows the account label with a new acme_client source filter.

Security

• ACME EAB HMAC keys encrypted at rest — external account EAB secrets (acme_client_accounts.eab_hmac_key and the legacy acme.client/acme.proxy SystemConfig values) are now encrypted with the master key on write, transparently decrypted on read, and rewritten by migration 061 where encryption is enabled. Legacy plaintext values remain readable.

---

📜 Recent release history (last 2 versions)

[2.198] - 2026-07-20

Changed

• SSO role mapping multi-match resolution is now formalized — when several of a user's external groups match mapping entries, the highest-privilege role wins (admin > operator > auditor > viewer). Previously the result silently depended on the storage order of the mapping entries. Documented in the role mapping help text. (#221)

Security

• ACME proxy no longer echoes upstream failure details — directory, nonce, order, authorization and challenge errors now return a generic message to the ACME client, with the diagnostic kept in the server log. A URL slug matching no enabled proxy endpoint returns 404 instead of a 500.
• ACME proxy finalize fails closed — an order bound to an owner is refused (403) when no requester identity can be derived from the verified JWS, instead of proceeding unbound.

Fixed

• SSO mapping editor row shuffling — editing the external-group name of any row no longer reorders the list on every keystroke, and transiently typing a name that collides with another entry no longer destroys that entry. Rows now keep a stable identity while editing. (#222)
• mTLS certificate PKCS12 export with encryption at rest enabled — the export read the stored private key without decrypting it, so it failed whenever key encryption was active. An unusable stored key now returns a clear error instead of a generic server error.
• dns-01 challenge TXT name for wildcard domains — the wildcard prefix strip removed any leading run of * and . characters, producing a wrong _acme-challenge owner name for domains whose label started with a dot-adjacent wildcard form.
• Certificate requests with an invalid CSR signature are now rejected (400) instead of being accepted for issuance.
• Revocation with a future invalidity_date is now rejected (400) — RFC 5280 §5.3.2 defines it as a past compromise time (5 minutes of clock skew allowed).
• Removing a certificate hold no longer leaves the certificate mis-staged when the delta CRL removeFromCRL entry cannot be written; the failure is reported instead of silently continuing, and a failed delta emission no longer aborts the unhold.
• EC curve names containing hyphens (ECDSA-P384, NIST P-521) are now accepted wherever a curve can be specified.

[2.197] - 2026-07-19

Added

• Named protocol URLs can be enabled on existing CAs — the opt-in previously available only at CA creation can now be enabled afterwards from the CRL & OCSP page (or PATCH /api/v2/cas/<id> with namedUrls). Auto-generated CDP/AIA URLs are rewritten to the slug form and newly issued certificates embed it; already-issued certificates keep their refid URLs, which continue to resolve. Enabling remains irreversible. (#207)

Fixed

• ACME proxy Link: rel="up" header — the authorization link returned on challenge responses doubled the /acme/proxy path segment, sending clients that re-poll their authorization (Traefik/lego) to a nonexistent URL. (#217)
• ACME proxy certificate download latency — DNS-01 TXT cleanup now runs in a background thread instead of blocking the certificate response on live DNS-provider API calls. (#218)
• ACME proxy order lookup on certificate download — the upstream certificate URL is now persisted on the proxy order when it first appears (finalize or order poll), so the download resolves its order with one indexed query instead of a live upstream round-trip per accumulated pending order. (#219)
• ACME proxy no longer forwards the upstream Link header — its rel="alternate" entries point directly at the real CA and cannot be authenticated by proxy clients; the preferred chain is already resolved server-side and served in the body. (#220)
• CRL & OCSP details panel layout — the "Full CRL Schedule" and "Delta CRL" blocks now render as framed sections, consistent with the rest of the panel.

Full history: CHANGELOG.md

---

Installation

Docker (Recommended)

# From Docker Hub
docker pull neyslim/ultimate-ca-manager:2.199

# Or from GitHub Container Registry
docker pull ghcr.io/neyslim/ultimate-ca-manager:2.199

# Run
docker run -d -p 8443:8443 \
  -e SECRET_KEY=$(openssl rand -hex 32) \
  --name ucm neyslim/ultimate-ca-manager:2.199

Debian/Ubuntu

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.199/ucm_2.199_all.deb
sudo dpkg -i ucm_2.199_all.deb
sudo apt-get install -f

Fedora/RHEL

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.199/ucm-2.199-1.fc43.noarch.rpm
sudo dnf install ./ucm-2.199-1.fc43.noarch.rpm

Silent/Automated Install

# Skip firewall prompts for CI/automation
sudo UCM_PORT=8443 UCM_FIREWALL=no dpkg -i ucm_2.199_all.deb

Default Credentials

• Username: admin
• Password: changeme123

Change the password immediately after first login!

Documentation

• Installation Guide
• API Documentation