v2.221-rc1

📜 Recent release history (last 2 versions)

[2.220] - 2026-09-04

Added

• Name constraints can now be set when creating a CA. The Create CA wizard's Advanced Constraints section gained permitted and excluded subtree fields (DNS, IP range, email), and POST /api/v2/cas accepts nameConstraintsPermitted / nameConstraintsExcluded as {type, value} lists and emits them as the critical NameConstraints extension. The request validation previously required plain strings while the extension builder expected objects, so no payload actually produced a constrained CA; malformed entries are now rejected with 400 at the API boundary instead of being silently dropped or producing an unusable CA: unknown type, IP network with host bits set, empty value, a DNS value that is not a plain domain (URL, path, wildcard, underscore, or an RFC-5280-invalid leading dot), an e-mail value that is not a mailbox, host or .domain form with a valid local part, and non-ASCII values. rfc822Name constraints are also now enforced against the subject DN emailAddress attribute, not only SAN e-mail addresses, on every issuance path, and the three e-mail constraint forms are matched per RFC 5280 (example.com = that host only, .example.com = its subdomains only, user@example.com = that mailbox) so a constrained CA no longer issues certificates that fail OpenSSL chain validation. Constraints entered for an external-CSR CA are refused, since the signing CA applies them there. They still cannot be changed after creation, as the extension is part of the signed certificate (#316, reported by @JoseGoncalves, contributed by @Hemsby)
• The certificate template editor's Key Type dropdown now offers RSA-3072 and EC-P521. Both were already accepted by the template API and produced working certificates at issuance; only the dropdown was missing them (#318 follow-up)

Fixed

• ACME proxy: a domain the upstream CA has already validated (a pre-validated or onboarded domain, typically on an EAB-bound account) no longer fails with "Upstream CA does not offer dns-01 challenge". An authorization the upstream reports as valid is now passed through untouched, so the client goes straight to finalize; a pending authorization without a dns-01 challenge is still refused, since the proxy can only automate dns-01 (#325, reported by @spijker)
• Certificate expiry alerts: every selected alert day is now stored and used. Saving 14, 7, 3 and 1 kept only 14 because the configuration row had a single threshold column, and the daily job then sent a reminder every day once a certificate entered that single window. Each selected threshold now fires once per validity period (and again after a renewal), the Include revoked certificates toggle is persisted and honoured, invalid selections are rejected with 400, and the in-memory alert settings module the scheduler never read has been removed. Upgrade note: existing installs keep their current single threshold until a new selection is saved, and alerts that used to repeat daily inside the window now go out once per threshold (#323, #324, reported by @JoseGoncalves)
• Email settings: choosing the None authentication method no longer shows Password after a reload. The API reported the stored default method even when SMTP authentication was off and dropped none on save; it now reports none whenever authentication is disabled, accepts it, and the form derives the highlighted method from that field (#322, reported by @JoseGoncalves)
• Certificate issue form: picking an EC certificate template (or switching Key Type from RSA to ECDSA) filled Key Type but left Key Size blank, so issuance failed with "EC curve must be P-256, P-384, or P-521". The Key Size dropdown swaps its options when the key type changes, and the shared Select wrapper was forwarding the reset event the list swap triggers as a real selection, wiping the value; it now ignores a change to a value that is not one of its current options. The same latent problem in the Create CA wizard's key size field is fixed by the same change. The issue API also fills the key size from the template when the request sends a key type but no size, on both the direct and the approval-workflow issuance paths, so an approved request for an EC template no longer drops to a P-256 key; a non-string key type in the payload now returns 400 instead of 500 (#318, reported by @JoseGoncalves, contributed by @Hemsby)

Security

• Private-key encryption now stops creating plaintext key mirrors and removes existing mirrors when enabled and at startup; Settings reports the on-disk count, disabling encryption recreates the mirrors, and Deployment adds a same-host SFTP preset for services that need key files. Upgrade note: on the first start with key encryption enabled, plaintext key files under the private directory are removed; anything that read them directly must move to deploy hooks (same-host SFTP target) or the API export. Certificate files are untouched (#320, reported by @kzshantonu)

[2.219] - 2026-09-01

Fixed

• Local ACME accounts created from the admin UI now store their contact e-mail in the RFC 8555 format, so the address shows up in the accounts list and detail panel instead of a bare "Account #N"; accounts created before this fix keep displaying their address through a legacy-format fallback, and editing the e-mail also normalizes the stored value
• The 2.218 ACME and HTTPS quality-of-life additions are now actually discoverable: the account e-mail edit is a labeled button spanning the detail grid (it rendered as a cryptic icon squeezed against the address), the client orders got their own "Let's Encrypt orders" sidebar tab mirroring Local orders (the in-section list was easy to miss), and Settings > HTTPS states explicitly when no certificate is bound instead of showing nothing (#303, reported by @gb-123-git)

Full history: CHANGELOG.md

---

Installation

Docker (Recommended)

# From Docker Hub
docker pull neyslim/ultimate-ca-manager:2.221-rc1

# Or from GitHub Container Registry
docker pull ghcr.io/neyslim/ultimate-ca-manager:2.221-rc1

# Run
docker run -d -p 8443:8443 \
  -e SECRET_KEY=$(openssl rand -hex 32) \
  --name ucm neyslim/ultimate-ca-manager:2.221-rc1

Debian/Ubuntu

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.221-rc1/ucm_2.221.rc1_all.deb
sudo dpkg -i ucm_2.221.rc1_all.deb
sudo apt-get install -f

Fedora/RHEL

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.221-rc1/ucm-2.221.rc1-1.fc43.noarch.rpm
sudo dnf install ./ucm-2.221.rc1-1.fc43.noarch.rpm

Silent/Automated Install

# Skip firewall prompts for CI/automation
sudo UCM_PORT=8443 UCM_FIREWALL=no dpkg -i ucm_2.221.rc1_all.deb

Default Credentials

• Username: admin
• Password: changeme123

Change the password immediately after first login!

Documentation

• Installation Guide
• API Documentation