v2.243

What's Changed

Upgrade notes

• SAML: responses are now validated strictly; check the IdP clock and that its SP entity ID, ACS URL and issuer match the SP metadata (set the Base URL). Existing providers keep IdP-initiated logins and have request signing turned off; new providers start with IdP-initiated login off (see Security).
• Policies: "Notify on policy violation" is on by default, so existing policies start e-mailing their addresses, approval group or approvers (see Added).
• Policies: the maximum validity and maximum number of DNS names now also bind ACME, SCEP, EST and WSTEP; the default 50-name maximum makes larger ACME orders fail (see Fixed).
• ACME: "Allow wildcard" is now enforced by the server and the proxy; check it is on for every domain that issues wildcards (see Fixed).
• ACME client: turning "Auto-renewal" off now stops every scheduled renewal; if it was off, check the Let's Encrypt tab before upgrading (see Fixed).
• Discovery: existing scan profiles start sending notifications; set the address or clear the switches to stop them (see Fixed).
• Reports: the legacy expiry and compliance switches become schedules at 08:00 UTC; check Reports > Schedule (see Removed).
• Integrations: a saved secret no longer follows a new server, URL, port, TLS setting, tenant or account, so such a change asks for the secret again; moving the SMTP server also drops the OAuth refresh token, which needs a new consent (see Security).
• API keys: a key that fails is refused even with a session cookie, and a bearer token counts as a key only with the ucm_ak_ prefix (see Added).
• CA private keys: exporting one or taking a CA offline with its key now needs read:private_keys as well as write:cas (see Security).
• Passwords: the admin_bypass_password_policy setting is deleted and administrators follow the password policy (see Removed).
• Templates: allowed SAN types are enforced only once "Enforce the allowed SAN types" is on; existing templates keep it off, new ones have it on (see Fixed).
• Custom roles: assigned roles now grant their permissions, the administrator-only ones excepted; review roles and assignments before upgrading (see Security).
• Groups: the default Certificate Operators and Auditors groups now grant their permissions to their members; review their members before upgrading (see Fixed).
• Audit log: back up audit-chain.keys with master.key, beside which it is written (see Security and docs/SECURITY.md).
• Docker Compose: /etc/ucm is now the named volume ucm-config; copy master.key out before switching (see Fixed and UPGRADE.md).

Added

• Settings > Security can restrict the web interface and the management API to a list of IP addresses and networks (or UCM_ADMIN_ALLOWED_NETWORKS), while PKI protocol endpoints and health checks stay reachable from anywhere; a list that would lock out the current admin is refused, and UCM_ADMIN_ALLOWLIST_DISABLE=1 lifts it after a lock-out (#402, requested by @Stryker-88).
• A policy can now govern revocations and renewals as well as issuance: revoking a certificate (alone, in bulk, a user certificate) or an intermediate CA, and renewals by an operator or the scheduler, are queued for approval and performed with the requested parameters once approved; ACME revocations it covers are refused, and so is removing an mTLS enrolment (409) until its certificate is revoked. Existing policies keep governing what they did.
• The policy setting "Notify on policy violation", on by default, now sends its e-mail: existing policies start mailing on upgrade when the policy refuses an operation or holds one for approval, to the policy's new notification addresses, else its approval group, else every user with write:approvals (untick the setting to stop it). A repeated refusal is reported once per hour.
• A registered security key (WebAuthn) can now complete a password login as the second factor, next to the TOTP code and recovery codes. It also satisfies enforced 2FA: it can be registered instead of TOTP at forced enrolment, TOTP can be turned off while a key remains, and the last key cannot be removed while TOTP is absent.
• A security key can also be turned on as second factor without enforced 2FA (My Account, once a key is registered): password logins then ask for it, the last factor cannot be removed, and a key that became the second factor stays when an administrator lifts enforcement.
• Administrators can list, disable and remove another user's security keys from the user's details (Users), so a lost key stops signing in without a password; removing the last factor of required 2FA asks for a second confirmation.
• Reports: a Revoked Certificates report (period, optional reason filter) can be generated, downloaded and scheduled.
• API keys are also accepted as Authorization: Bearer ucm_ak_..., with the same scopes and CSRF exemption as X-API-Key; a key that fails is now refused instead of falling back to the browser session. A bearer token without the ucm_ak_ prefix, such as an IdP token relayed by an authenticating proxy, is ignored and the session applies as before.
• SAML providers have a NameID format setting (unspecified, persistent, email address or transient), sent in each AuthnRequest and published in the SP metadata; the format used to be read from a setting that could not be saved, so UCM always asked for "unspecified".
• Settings > Security: the OCSP responder certificate auto-renewal switch and its window (days before expiry), which the daily task already read but nothing could set.
• ACME DNS providers: Plesk, through its XML API; TLS verification can be turned off for a self-signed panel and a propagation delay added (#401, by @ziller-hqs).

Changed

• Licence: UCM is now released under AGPL-3.0-only, with a commercial licence for those who modify it and cannot publish their changes (see COMMERCIAL-LICENSE.md). Versions up to 2.242 remain under BSD 3-Clause with the Commons Clause.
• Backups: deleting archives while another backup operation holds the lock answers 409 instead of 500.
• ACME EAB: an allowed-domains entry of *. and a PATCH that sets the list to null are refused with a 400 instead of being read as "every domain" and "block everything".
• mTLS: a client certificate presented on a PKI protocol or health endpoint no longer signs its holder in to the web interface; certificate login goes through the interface as before (#402).
• Packaging: the DEB ucm.env offered SESSION_TIMEOUT and RATE_LIMIT_PER_MINUTE/RATE_LIMIT_PER_HOUR, which nothing applied; it now offers the RATE_LIMIT_*_RPM and *_BURST limits UCM reads. Session lifetime is set in Settings > Security.

Removed

• ACME: EAB keys still kept in the pre-2.139 acme_eab_keys setting registered accounts without appearing anywhere; the upgrade moves them to ACME > EAB as active credentials, where they can be seen and revoked, and the old setting is no longer read; an entry that is not a key pair stays in that setting rather than being deleted. Nothing to do.
• The undocumented admin_bypass_password_policy setting, which let administrators skip the password policy when set in the database, is gone and the upgrade deletes it; administrators now follow the policy like everyone else. Nothing to do.
• Settings > Audit: the "Enable audit logging" switch and the "Events to log" checkboxes were stored nowhere and changed nothing; they are gone. The audit log always records every event; use the remote syslog categories to forward a subset.
• Groups: the per-member role (member/admin) of the API was stored but never applied, since managing a group always takes the global admin role; it is no longer accepted or returned. Nothing to do: API clients that still send it are not refused.
• ACME: the global "Enable ACME proxy" switch of the Let's Encrypt tab is gone, since turning it off never stopped the proxy, and the upgrade deletes the setting. To stop a proxy endpoint, turn off "Expose via ACME proxy" on its CA account, or clear the CA account selected for the default proxy path.
• ACME proxy: the copies of the upstream account URL and EAB credentials kept in settings beside the proxy's CA account are gone and the upgrade deletes them; proxy_eab_kid and proxy_eab_hmac_key of the client settings API now write the selected CA account and are refused when none is selected. Nothing to do from the UI, which edits EAB on the CA account.
• ACME DNS providers: the zones list of the API was stored but never used, since ACME > Domains decides which provider answers for a domain; it is no longer accepted or returned. Map each domain in ACME > Domains instead.
• Policies: the required_extensions and san_restrictions.require_approval_for_external rules were saved but never enforced; they are dropped on save and the upgrade removes them from existing policies. Nothing to do: approval is set per policy with "Requires approval".
• Reports: the legacy expiry and compliance report switches made the Reports page show a daily expiry report that never ran. The upgrade turns one switched on with recipients into a real schedule and removes the rest; check Reports > Schedule after upgrading.
• HSM: the "Enable provider" switch of the provider form was never sent; it is gone. Nothing to do: a provider shows as enabled once its connection test succeeds.
• SSH CAs: the RSA key size selector was ignored and every RSA SSH CA was 4096-bit; the selector is gone and the algorithm reads "RSA 4096". Nothing to do.
• API: owner_group_id on SSH CAs and SSH certificates was stored, and returned for CAs and certificates, but no access control read it; it is no longer accepted or returned. Use roles to restrict access.
• API: PATCH /api/v2/cas/<id> accepted is_active and logged it as a change, but CAs have no such flag and nothing was stored; the field is now ignored. Take a CA offline to stop it signing.
• SCEP: the "CA Identifier" and SCEP URL settings were never read by any SCEP exchange; they are gone and the upgrade deletes them. Nothing to do: use a profile URL to target a specific CA.
• Settings: site_name was only shown in place of an empty "System Name", which is in fact the syslog HOSTNAME; the field is now labelled "Syslog hostname" and the upgrade carries site_name into it when it was empty, then deletes it.
• Settings: the internal app.initialized and https.enabled keys were seeded at startup and never read; they are no longer created and the upgrade deletes them. Nothing to do.
• Notifications: the subject_template field of a notification setting was never read or written; it is no longer exposed. Nothing to do.
• Packaging: the DEB and RPM packages, the native setup, the Docker image and the Helm chart no longer generate a JWT secret (JWT_SECRET_KEY, UCM_JWT_SECRET, secrets.jwtSecret), which nothing used. An existing value is ignored and can be deleted.
• Configuration: the SCEP_* environment variables were loaded at startup and never used, and the DEB ucm.env still offered them; in particular SCEP_ENABLED=false never turned SCEP off. They are removed from ucm.env and existing lines are ignored: SCEP is enabled or disabled in Protocols > SCEP only.
• Docker: .env.docker.example offered data directories, PostgreSQL credentials and resource limits that no compose file uses, and the dev compose set SQL_DEBUG, which nothing read; they are gone. Nothing to do: data lives in the ucm-data volume.

Fixed

• Backup restore: an ACME EAB credential limited to some domains came back unrestricted and without its notes, because neither column was restored.
• Policy notifications: a mail that failed to send blocked the next attempt for an hour; a refusal now tries again after five minutes, while a sent or in-flight mail still holds back repeats for the hour, and nothing is attempted while SMTP is off.
• Policy notifications: on SQLite, a new approval request or policy that reused the id of one deleted within the hour was not reported; the notification key now also carries its creation time.
• POST /api/v2/audit/cleanup deleted every entry older than the retention, even one behind a newer entry, which broke the chain; it now purges the oldest entries as the scheduled retention does.
• Scheduled reports were emailed without the report attached and always announced as CSV; the file is now attached in the schedule's format (CSV, JSON or PDF), and a test send that fails says so.
• Scheduled PDF reports saved from the Reports page were silently dropped by the API; each PDF template can now be scheduled.
• Reports: a schedule or test send with a malformed body or a non-text format answered 500; the body is refused with 400 and an unknown format falls back to CSV.
• Locking an account after too many failed password or LDAP logins never sent the security alert e-mail; it is now sent when the account is locked, at most once per lockout and within the security alert's cooldown for that account.
• Exporting a certificate or CA private key (PEM, PKCS#12, PFX, JKS or bare key) left no audit entry; each export is now recorded with the user, the format and whether it was password-protected.
• Docker: the bundled compose files left /etc/ucm (master.key) on an anonymous volume, so docker compose down then up lost the key to every encrypted private key; they now mount the named volume ucm-config (see UPGRADE.md before switching).
• Without UCM_DB_ENCRYPTION_KEY, an empty /etc/machine-id (common in containers) made UCM derive a new key at every start, so stored integration secrets (SMTP, LDAP, DNS, SSO, webhooks) became unreadable after a restart; the persisted .machine-key is now used, created once (mode 0600) even when several workers start together.
• Certificate Transparency: the built-in log list named Google's retired Argon 2026h1 shard; it now lists Google Argon and Cloudflare Nimbus shards accepted today. Embed SCTs and Require SCTs applied even with CT disabled; they now apply only while CT is enabled, and the settings page hides them otherwise.
• Certificate Transparency settings could not be saved while no log list was set (the page sent back the null it had read and got a 400); null now keeps the built-in logs.
• mTLS and EST behind a reverse proxy: a client certificate forwarded URL-encoded in X-SSL-Client-Cert (nginx $ssl_client_escaped_cert) could not be read; raw, URL-encoded and space-folded (Apache) PEM are accepted, and EST also takes bare base64 DER, still only from trusted proxies.
• Settings > Security showed an "API Rate Limit" field that was never saved nor applied; it is removed. Rate limits are set with the RATE_LIMIT_* environment variables.
• HSM: an AWS CloudHSM provider created from the form could not connect, since neither its token label nor its crypto user reached the PKCS#11 login. The form now asks for the token label and logs in as <crypto user>:<password>; the unused Region and AWS access key fields are gone.
• SCEP: the challenge password validity field stopped at 168 hours while the API accepted up to 720; the form now takes its bounds (1 to 720 hours) from the API.
• The in-app help no longer lists Buypass, which stopped issuing certificates on 15 October 2025.
• docs/HSM_DOCKER.md said a key sync against an empty SoftHSM token removes every key record; since 2.240 it keeps the keys a CA uses, and the page now says so.
• Helm: initialAdminPassword had no effect and every install started with the default changeme123; the chart now passes it under the name the image reads, and the image also honours INITIAL_ADMIN_PASSWORD.
• A change to the password policy (minimum length, character classes) only applied after a restart; it now applies at once in every worker.
• ACME: "Allow wildcard" on a domain had no effect; the ACME server and the ACME proxy now refuse *. identifiers for a domain where it is off (rejectedIdentifier). Upgrade note: the switch is on by default; check it is on for every ACME domain that should keep issuing wildcards, on the ACME server as on the proxy.
• HSM: Azure Key Vault ignored the tenant, client ID and secret typed in the form and signed in with the host's ambient identity; it now uses them, and falls back to the managed identity only when all three are empty.
• ACME server: whether HTTP-01 and TLS-ALPN-01 may reach private addresses could only be changed in the database, and the in-app help pointed at a page that does not exist; the switch is now under ACME > Local ACME > Challenge targets.
• Users: the user detail showed "Enable 2FA" and "TOTP" as off for every user, and never offered "Reset 2FA", because it read fields the API does not set; it now shows the real two-factor state, a security key used as second factor included, and the unused mfa_enabled field is no longer returned.
• Certificate Transparency: "Auto-submit new certificates to CT logs" only applied to mTLS enrolment certificates; with embedding off, every issuance path (form, CSR, renewal, approval, ACME, SCEP, EST) now submits the certificate in the background once it is issued, so a slow log never delays the issuance.
• ACME client: turning off "Auto-renewal" in the Let's Encrypt tab did not stop scheduled renewals; it now does, and the per-order switch still applies when it is on.
• ACME client: the renewal threshold (renewal_days, accepted by the API) was ignored and renewals always started 30 days before expiry; it is now applied when the CA gives no ARI window, and set in the Let's Encrypt tab (1 to 60 days).
• Policies: the maximum validity and maximum number of DNS names only applied to the issue form, CSR signing, renewals and approvals; ACME, SCEP, EST and WSTEP now cap the validity and refuse a request with too many DNS names as well. Upgrade note: a policy saved from the Policies page carries a 50-name maximum by default, so an ACME order with more names now fails at finalize (badCSR); raise it on active policies that cover larger requests.
• Templates: a disabled template was still used by the issue form, CSR signing, approvals and new SCEP and ACME profile bindings; these now refuse it, as Windows enrollment already did.
• WSTEP: certificates were issued for the global WSTEP validity even when the request matched a template whose own validity XCEP advertises; the matched template's validity now applies, the global value only when no template matches.
• Discovery: scan notifications were never sent and the profile's Notification Email was not saved; the digest now goes to that address, or to the SMTP sender address when it is empty, and reports an expiring or expired certificate once rather than at every scan. Upgrade note: existing profiles start sending (new, changed and expiring certificates are on by default); set the address or clear the switches on each profile to stop them.
• HSM: a Google Cloud KMS provider could only use the server's ambient credentials, the form having no field for a service account key; it now takes one, kept encrypted and masked like the other secrets, and can be removed again to return to the default credentials.
• Docs: the admin guide gave native installs the Docker-only UCM_* variable names (UCM_SECRET_KEY, UCM_DATA_DIR...), which ucm.env does not read; it now lists both names.
• Templates: the "Subject Alternative Names" types of a template were never enforced. A new "Enforce the allowed SAN types" switch makes the issue form, Sign CSR, ACME profiles, SCEP, WSTEP, renewals and approvals refuse a request carrying another name type, naming it. Upgrade note: existing and built-in templates keep accepting every type until the switch is turned on (the built-in client, VPN client and smartcard lists now include the names those certificates carry); new templates have it on.
• OCSP: on PostgreSQL, the response for a certificate revoked with a reason was never cached, its reason name going into an integer column, and a SQLite database holding such rows could not be migrated to PostgreSQL. The cache stores the CRLReason code, and existing rows are converted at upgrade.
• CSRs: a Windows or Intune request (CA:FALSE with a path length) failed to upload with an error 500 and could not be signed or approved; it now goes through like any other, and so do an ACME order finalized with such a request, EST re-enrolment and server key generation, and the import of such a CSR.
• ACME client: an order invalidated by a failed challenge said "Order became invalid: Unknown"; it now gives the error the CA reported for the challenge (#401, by @ziller-hqs).
• WSTEP in FIPS mode: Windows CertEnroll signed its request with SHA-1, refused and reported as a proof-of-possession failure. XCEP now announces a SHA-2 request hash (schema 3, KSP) in FIPS mode, and the refusal is named (#404, by @clinde04).
• Users: opening a default group crashed the page and those groups granted nothing, their permissions having been stored as text; they are now lists, and the Administrators group, which a group cannot be, is no longer created (#399).
• RBAC: the built-in roles showed 0 users; they now count the users holding them (#399).

Security

• Settings: a migration deletes the ldap_* keys left over from the legacy LDAP configuration, bind password included; SSO providers are untouched.
• An Operator, or any account or API key holding write:cas, could export the private key of any CA (PKCS#12, PFX, JKS, key file, PEM with key) or take it as a file by taking the CA offline. Both now also require read:private_keys, as a certificate key export does: an account or API key that exports CA keys now needs that scope, held by administrators or granted by a custom role.
• A custom role assigned to a user granted none of its permissions, while the effective-permissions view listed them. Assigned custom roles now add their permissions to the built-in role, inherited ones included, except those kept for administrators (full access, wildcards, admin:*, account management, SSO, deployments, AD connector and HSM provider changes, system events, audit deletion), which stay stored but ignored: review existing roles and their assignments before upgrading.
• Testing the AD connector, a Microsoft CA admin channel or an Intune app registration with the secret left blank reused the saved secret with the server, port, TLS settings, tenant or client typed in the request, so it could be sent to a server of the caller's choosing. The saved secret now goes only to the saved target; any other target needs it typed in.
• Saving the SMTP, webhook, DNS provider, SSO, Microsoft CA, AD connector, HSM provider or Intune settings with a new server, URL, port, TLS setting, tenant or account kept the saved secret, which then went to the new target. Such a save is now refused until the secret is typed again (the forms ask for it), and a Microsoft CA connection password is no longer reused for a WinRM host other than the CA's own.
• Moving the SMTP server, port, security or account now drops the saved secret the chosen authentication method does not use and the OAuth refresh token, so OAuth needs a new consent.
• Audit log: the hash chain was plain SHA-256, so anyone able to write the database could edit an entry and recompute the chain behind it. With a master key, entries are now sealed with HMAC-SHA256 under a key derived from it (existing entries still verify), the integrity check reports intact, broken at entry N or not protected, and a purge leaves a sealed record so the chain still verifies after it.
• SAML responses were accepted on their signature alone (no audience, Destination, validity window or InResponseTo check, replays possible); they are now validated strictly, tied to the login started in the same browser (a refused POST does not cancel it) and accepted once. Check that the IdP clock is within five minutes and that its SP entity ID, ACS URL and issuer match /api/v2/sso/saml/metadata (they come from the admin Base URL, else FQDN, else the request's address, so set the Base URL); existing providers keep accepting IdP-initiated logins, while new ones have "Allow IdP-initiated login" off: turn it on when users start from the IdP portal.
• SAML "Sign authentication requests" was saved but never applied, and the SP metadata always announced unsigned requests. Requests are now signed with the key of the chosen SP certificate (RSA only) when the option is on; it has been turned off on existing providers, matching what UCM actually sent.

---

📜 Recent release history (last 2 versions)

[2.242] - 2026-10-18

Added

• Administrators see a small dismissible card suggesting support on Ko-fi, once per UCM version after an install or update, and Settings > About links to it.

Fixed

• A preference change (language, theme, a dismissed window) made before the user's saved preferences had loaded (just after signing in, or after a failed load) replaced them all on the server; it is now saved together with them once they load.
• DEB and RPM: an upgrade rebuilt the Python environment while UCM was still running on it, which logged errors such as a missing CA bundle for the update check (up to five minutes with UCM_FIPS_BUILD=1). The service is now stopped during the rebuild and started again on the previous environment when the build fails or is interrupted, and the update screen waits up to ten minutes for it.
• DEB: the install banner listed softhsm2 as missing when apt installed it in the same run.
• FIPS mode (Docker): the module was installed without -pedantic, which left the Extended Master Secret check and the DRBG digest restriction of its approved mode off. Both are now on and UCM refuses to start when a required setting is off (the service status lists them); TLS 1.2 peers without Extended Master Secret are refused.
• FIPS mode (Docker): the HTTPS server and UCM's TLS clients negotiated X25519, which the module's security policy does not allow. TLS now uses only the NIST curves and FFDHE groups, and UCM refuses to start in FIPS mode when TLS still accepts X25519 or X448.
• FIPS mode: SSH deployments checked Ed25519 host keys with libsodium and could fall back to a Diffie-Hellman key exchange computed outside the module. They now negotiate only ECDSA or RSA host keys, ECDH on NIST curves, AES and HMAC-SHA-1/SHA-2, and a target pinned to an Ed25519 host key asks for a pin reset.
• FIPS mode: with a Kerberos ticket present, libpq could encrypt the PostgreSQL connection with GSSAPI, which runs in the Kerberos library outside the module, instead of TLS. UCM now turns GSSAPI encryption off for itself and its backup tools, and refuses to start when gssencmode or PGGSSENCMODE asks for it.
• The PostgreSQL snapshot taken before a database migration ran pg_dump without the service's libpq settings (PGSSLMODE, PGSSLROOTCERT, PGGSSENCMODE…) when the URL did not repeat them. It now keeps them, as the live connection does, and FIPS mode turns GSSAPI encryption off for it.
• FIPS readiness report: it advised switching NTLM WinRM channels to Kerberos, which the Docker image cannot run; it now advises turning the channel off unless Kerberos is installed. It also reports deploy targets pinned to an Ed25519 host key, PostgreSQL set to GSSAPI encryption and private keys stored without a master key.

[2.241] - 2026-10-18

Added

• FIPS mode (preview): with UCM_FIPS=1, UCM refuses to start unless its crypto libraries run on an active OpenSSL FIPS provider and pass their self-tests and PostgreSQL is reached over TLS, generates keys through the provider, and refuses what it does not approve (Ed25519 and Ed448, MD5, 3DES, scrypt and Argon2id, legacy PKCS#12 and JKS exports, PKCS#12 import, SCEP key transport in PKCS#1 v1.5, NTLM to a Microsoft CA). UCM is not FIPS validated itself. This is a first release of FIPS mode: feedback is welcome on #399 (requested by @Stryker-88).
• Docker: building with UCM_FIPS_BUILD=1 adds the OpenSSL 3.1.2 FIPS provider (CMVP certificate #4985) and links cryptography, psycopg2 and xmlsec to the system OpenSSL; the image runs in standard mode without UCM_FIPS, and the Helm chart has fips.enabled (#399).
• Service status shows the OpenSSL library and FIPS provider in use, and /api/v2/health reports fips_active (#399).
• Backups: "kdf": "pbkdf2" at creation writes an archive that a FIPS-mode instance can restore (#399).
• DEB and RPM: with UCM_FIPS_BUILD=1 in /etc/ucm/ucm.env before the install, RHEL 9 and Ubuntu 24.04 hosts build cryptography, psycopg2, lxml and xmlsec against the system OpenSSL, and a host in FIPS mode gets UCM_FIPS=1 and the readiness report (#399). Upgrades rebuild a package only when its version changed (pip's wheel cache otherwise), and the updater refuses the update when a build tool is missing.
• RPM for RHEL, AlmaLinux and Rocky Linux 9 (ucm-el9-2.243-1.el9.noarch.rpm), running on python3.12; the Fedora RPM is unchanged and the updater picks the build matching the host.
• FIPS readiness check: python -m scripts.fips_preflight, GET /api/v2/system/fips-preflight and a button under Settings > About list, on a standard instance, what FIPS mode would refuse (scrypt passwords, Ed25519 authorities, hmac-md5 TSIG, Argon2id backups, PostgreSQL without TLS...) with a remedy for each; scheduled backups gain a KDF setting (#399).

Changed

• Upgrade note: SAML responses and assertions signed or digested with SHA-1 are refused; an identity provider still using SHA-1 (an older ADFS relying party trust, for instance) must switch to SHA-256 (#399).
• Upgrade note: WSTEP requests whose WS-Security signature does not use RSA or ECDSA with SHA-256, SHA-384 or SHA-512 are refused (#399).
• python-jose, which nothing used, is no longer installed (#399).

Fixed

• DEB and RPM: an /etc/ucm/ucm.env written before the install was kept as is, without secrets, and the service did not start. Missing secrets and defaults are now added, without changing any value already there.

Full history: CHANGELOG.md

---

Installation

Docker (Recommended)

# From Docker Hub
docker pull neyslim/ultimate-ca-manager:2.243

# Or from GitHub Container Registry
docker pull ghcr.io/neyslim/ultimate-ca-manager:2.243

# Run
docker run -d -p 8443:8443 \
  -e SECRET_KEY=$(openssl rand -hex 32) \
  --name ucm neyslim/ultimate-ca-manager:2.243

Debian/Ubuntu

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.243/ucm_2.243_all.deb
sudo dpkg -i ucm_2.243_all.deb
sudo apt-get install -f

Fedora

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.243/ucm-2.243-1.fc43.noarch.rpm
sudo dnf install ./ucm-2.243-1.fc43.noarch.rpm

RHEL, AlmaLinux, Rocky Linux 9

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.243/ucm-el9-2.243-1.el9.noarch.rpm
sudo dnf install ./ucm-el9-2.243-1.el9.noarch.rpm

FIPS mode (preview)

FIPS mode is a preview: feedback is welcome on #399. Full guide: FIPS Mode.

Docker, any Linux host (amd64, arm64):

docker run -d -p 8443:8443 -e UCM_FIPS=1 \
  -v ucm-data:/opt/ucm/data -v ucm-config:/etc/ucm \
  --name ucm neyslim/ultimate-ca-manager:2.243-fips

Ubuntu 24.04 with Ubuntu Pro (sudo pro enable fips-updates, then reboot):

sudo apt-get install -y gcc pkg-config python3-dev python3-venv libpq-dev libxml2-dev libxslt1-dev \
    zlib1g-dev libssl-dev libxmlsec1-dev libxmlsec1t64-openssl rustc-1.91 cargo-1.91
sudo install -d -m 750 /etc/ucm && echo 'UCM_FIPS_BUILD=1' | sudo tee /etc/ucm/ucm.env
sudo apt install ./ucm_2.243_all.deb

RHEL, AlmaLinux, Rocky Linux 9 (sudo fips-mode-setup --enable, then reboot; on RHEL, enable CodeReady Builder instead of CRB):

sudo dnf config-manager --set-enabled crb
sudo dnf install -y python3.12-devel gcc pkgconf-pkg-config libpq-devel libxml2-devel libxslt-devel \
    openssl-devel xmlsec1-devel xmlsec1-openssl libtool-ltdl-devel rust cargo
sudo install -d -m 750 /etc/ucm && echo 'UCM_FIPS_BUILD=1' | sudo tee /etc/ucm/ucm.env
sudo dnf install ./ucm-el9-2.243-1.el9.noarch.rpm

The package builds its crypto libraries against the system OpenSSL (about five minutes), sets UCM_FIPS=1 on a host in FIPS mode and prints a readiness report. Fedora, Debian and other distributions are not supported in FIPS mode: use the Docker image.

Silent/Automated Install

# Skip firewall prompts for CI/automation
sudo UCM_PORT=8443 UCM_FIREWALL=no dpkg -i ucm_2.243_all.deb

Default Credentials

• Username: admin
• Password: changeme123

Change the password immediately after first login!

Documentation

• Installation Guide
• API Documentation