v2.224-rc1

📜 Recent release history (last 2 versions)

[2.223] - 2026-09-06

Fixed

• Automatic updates on the rc channel refused every release candidate with "Release checksum does not cover this package". The checksum file published with a release candidate names the package as built (ucm_2.223~rc1_all.deb) while GitHub publishes the asset with a dot (ucm_2.223.rc1_all.deb), and the updater compared the two names literally. The updater now matches the names with that transform applied, and the release build writes the published asset name into the checksum file so earlier versions can update to a release candidate too
• Startup no longer depends on the HTTPS certificate binding being readable. The one-time backfill that binds a certificate applied before bindings existed runs under its own application context and treats a database error while reading the binding as "no binding" with a warning, instead of aborting application start; a failed read on the first boot after an update, with the database not yet available, could otherwise keep the service down
• Certificate policy Rules are now enforced at issuance. The policy editor's Allowed Key Types and Max SANs were stored but never checked, and Max Validity only applied to requests routed through approval, so a policy shown as active could be ignored entirely. On the issue form and when an approved request is issued, a request whose key type is not in the policy's allowed list or which carries more DNS names than its maximum is refused with the rule named, and the validity is capped by the policy. Rules apply to every role, including administrators, who keep bypassing only the approval workflow; the DNS pattern keeps its role of scoping which requests a policy covers. Requests over ACME, SCEP, EST and WSTEP are not covered by policies, as before (#335, reported by @Hemsby)
• Revoking a certificate from the web UI now asks for the revocation reason. The confirm dialog had no reason field, so every manual revocation was recorded and published on the CRL as unspecified, with no way to correct it afterwards since revocation is one-way; only automated paths such as ACME renewal recorded a reason. The revoke dialog (certificates page, detail windows, user portal and bulk operations) now offers the RFC 5280 reason codes with a short explanation of each, defaulting to unspecified, and the certificate details show the chosen reason by name. The API rejects an unknown reason with 400 instead of storing it, accepts the snake_case spellings older clients used, and the CRL builder now maps the RFC spelling cACompromise that ACME revocations store (#334, reported by @JoseGoncalves)

[2.222] - 2026-09-06

Added

• PKCS#12 exports gained a compatibility mode. UCM's PKCS#12 archives use the OpenSSL 3 profile (PBES2 with AES-256-CBC, PBKDF2-SHA256 and an HMAC-SHA256 integrity check), which Android 15 and earlier, macOS 14 and earlier, Windows Server 2016 and earlier and Java before 8u301 / 11.0.1 cannot read and report as a wrong password. A Compatibility mode checkbox on the export dialogs (certificates, CAs, the user portal, mTLS downloads and key recovery) switches that archive to the 3DES/SHA-1 profile these importers accept, the same LegacyDES profile cert-manager and go-pkcs12 offer. The API takes it as legacy: true alongside password. AES-256 stays the default and the checkbox is a per-export choice, since the legacy profile protects the archive less well (#331, requested by @MakosHD)

Fixed

• The certificate template API no longer accepts ED25519 as a key type. It was allowed at save time but the issuance path cannot generate an Edwards key, so every certificate request from such a template failed with a 400. POST and PUT /api/v2/templates now reject it up front, and template import skips an ED25519 entry with a reason string instead of storing a template that can never issue. An existing ED25519 template must be switched to an RSA or EC key type before it can be edited again (#321 follow-up, contributed by @Hemsby)

Full history: CHANGELOG.md

---

Installation

Docker (Recommended)

# From Docker Hub
docker pull neyslim/ultimate-ca-manager:2.224-rc1

# Or from GitHub Container Registry
docker pull ghcr.io/neyslim/ultimate-ca-manager:2.224-rc1

# Run
docker run -d -p 8443:8443 \
  -e SECRET_KEY=$(openssl rand -hex 32) \
  --name ucm neyslim/ultimate-ca-manager:2.224-rc1

Debian/Ubuntu

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.224-rc1/ucm_2.224.rc1_all.deb
sudo dpkg -i ucm_2.224.rc1_all.deb
sudo apt-get install -f

Fedora/RHEL

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.224-rc1/ucm-2.224.rc1-1.fc43.noarch.rpm
sudo dnf install ./ucm-2.224.rc1-1.fc43.noarch.rpm

Silent/Automated Install

# Skip firewall prompts for CI/automation
sudo UCM_PORT=8443 UCM_FIREWALL=no dpkg -i ucm_2.224.rc1_all.deb

Default Credentials

• Username: admin
• Password: changeme123

Change the password immediately after first login!

Documentation

• Installation Guide
• API Documentation