Skip to content

Home

Jump to bottom
NeySlim edited this page Mar 12, 2026 · 59 revisions

Ultimate Certificate Manager - Wiki

Version License Docker CI/CD

Welcome to the Ultimate Certificate Manager (UCM) documentation! This wiki provides comprehensive guides for all features.

v2.69 Released! Executive PDF reports, full report scheduler (6 types, email delivery), redesigned Reports page, security & accessibility fixes. View Release Notes

📸 Screenshots

Dashboard

Dashboard

Certificate Management with Detail Panel

Certificates

Certificate Toolbox

Toolbox

Certificate Discovery

Discovery

Mobile & Tablet Support

Mobile Tablet
Mobile Tablet

✨ Key Features

🔐 Complete PKI Infrastructure

  • Full CA Management - Create, import, manage Certificate Authorities with hierarchy support
  • Certificate Lifecycle - Generate, sign, revoke, renew, export certificates
  • CSR Management - Create, import, sign Certificate Signing Requests
  • Certificate Templates - Predefined configurations for server, client, code signing
  • CRL & CDP - Certificate Revocation Lists with HTTP/HTTPS distribution points
  • OCSP Responder - Real-time certificate status validation (RFC 6960)
  • Trust Store - Manage trusted root CA certificates

🔍 Certificate Discovery

  • Network Scanning - Find TLS certificates on hosts, IPs, and CIDR subnets
  • Quick Scan - Instant scan without saving a profile
  • Scan Profiles - Reusable scan configurations with scheduling
  • SNI Probing - Multi-hostname TLS handshake for maximum coverage
  • Certificate Inventory - Track managed/unmanaged/expired/expiring certificates
  • Export - CSV and JSON export of discovered certificates
  • SSRF Protection - Blocks scanning of internal addresses

🧰 Certificate Toolbox

  • SSL Checker - Verify SSL certificates on any hostname (TLS version, cipher suite, expiry)
  • CSR Decoder - Parse and display CSR contents
  • Certificate Decoder - Analyze certificate details (extensions, SANs, key usage)
  • Key Matcher - Verify certificate and private key match
  • SSL Converter - Convert between PEM, DER, PKCS#12, PKCS#7 formats

📊 Reports & Analytics

  • Executive PDF Report - Multi-section PDF with cover page, risk assessment, compliance, charts (fpdf2/matplotlib)
  • Report Scheduler - 6 report types with daily/weekly/monthly scheduling and email delivery
  • On-Demand Reports - Generate and download CSV/JSON reports for certificates, CAs, compliance, audit
  • Stat Cards - At-a-glance report overview with schedule status

📡 Industry Standard Protocols

  • SCEP Server - RFC 8894 compliant auto-enrollment for network devices
  • ACME Support - Let's Encrypt compatible (certbot, acme.sh) with account management
  • EST Protocol - RFC 7030 Enrollment over Secure Transport
  • OCSP - Online Certificate Status Protocol responder
  • CRL/CDP - Certificate Revocation List distribution points

🔒 Advanced Security

  • SSO - LDAP, OAuth2 (Azure/Google/GitHub), SAML single sign-on with role mapping
  • WebAuthn/FIDO2 - Hardware security key support (YubiKey, Passkeys)
  • mTLS Authentication - Mutual TLS certificate-based authentication
  • TOTP Two-Factor - Time-based one-time passwords
  • Password Strength - Visual strength indicator with policy enforcement
  • Session Management - Timeout warning, force password change
  • Audit Logs - Full action logging with hash chain integrity verification
  • Rate Limiting - Brute force protection on login

👥 User & Group Management

  • RBAC - 4 system roles (Admin, Operator, Auditor, Viewer) plus custom roles with granular permissions
  • User Groups - Organize users with role-based access
  • API Keys - Generate keys for automation and integrations
  • Session History - Track all login sessions

🎨 Modern Interface

  • 6 Theme Variants - 3 color themes × Light/Dark modes
  • Auto Dark Mode - Follow system preference
  • Command Palette - Ctrl+K global search with quick actions
  • Floating Detail Windows - Draggable, resizable entity detail panels
  • Dashboard Charts - Certificate activity, status distribution, day selector
  • Real-time Updates - WebSocket-based live refresh
  • Responsive Design - Mobile-first with adaptive layouts
  • Contextual Help - Help modals on every page
  • 9 Languages - EN, FR, DE, ES, IT, PT, UK, ZH, JA

📚 Table of Contents

Getting Started

Core Features

User Interface

Advanced Topics

Administration

Development

🚀 Quick Links

Installation (v2.69)

  • Docker Hub: docker pull neyslim/ultimate-ca-manager:2.69
  • GHCR: docker pull ghcr.io/neyslim/ultimate-ca-manager:2.69
  • DEB: wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.69/ucm_2.69_all.deb
  • RPM: wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.69/ucm-2.69-1.fc43.noarch.rpm

Access

📖 What's New

v2.69 (Latest) ✨

  • Executive PDF Report — Multi-section PDF with cover page, risk assessment, compliance, charts
  • Report Scheduler — 6 report types with daily/weekly/monthly frequency and email delivery
  • Reports Page Redesign — List layout with stat cards, inline schedule status, mobile-responsive
  • Security Hardening — Input validation, email signature fix, info disclosure removal
  • Accessibility — type="button" on 18 buttons, aria-label on 9 icon-only buttons
  • Performance — Memoization, N+1 query fix, DB-level GROUP BY

Read Full Release Notes

v2.68

  • ACME Wildcard CSR Fix — Corrected wildcard certificate handling in ACME CSR generation
  • Certificate Import Metadata — Imported certificates now preserve original metadata
  • Discord UI Fixes — 4 visual fixes for the Discord theme variant

Read Full Release Notes

v2.52 ✨

  • Certificate Discovery — Scan networks for TLS certificates with profiles, quick scan, SNI probing
  • Security Hardening — 15 findings fixed: SSRF protection, brute-force limits, audit logging, LDAP encryption
  • Error Visibility — Scan errors shown with troubleshooting hints
  • In-App Help — Expanded help for discovery page (profiles, filters, errors, export, security)

Read Full Release Notes

v2.51

  • EST management page with config, stats, endpoint info
  • Certificate unhold, enriched system-status badges
  • WebSocket real-time updates, accordion sidebar
  • CSR generation form, enhanced certificate issuance
  • Global UI density harmonization

v2.50

  • Login architecture redesign with sessionChecked state guard
  • mTLS auto-login with seamless certificate-based authentication
  • 6 mTLS authentication fixes (session handling, error flows, logout)
  • Enhanced /auth/methods endpoint with dynamic capability detection
  • Consistent auth response contract across all login paths

Read Full Release Notes

v2.1.0 ✨

  • Redesigned Operations page (Import/Export/Bulk Actions)
  • Unified ExportModal with RBAC permission guards
  • Dashboard charts with day selector (7d/15d/30d)
  • RBAC with 4 system roles (Admin, Operator, Auditor, Viewer) plus custom roles
  • SSO support: LDAP, OAuth2 (Azure/Google/GitHub), SAML with role mapping
  • ACME multi-CA support
  • In-app contextual help system
  • Force password change on first login
  • 9 languages, 2273+ keys each
  • Reports & governance (policies, approvals)

Read Full Release Notes

v2.0.3 🔧 STABLE

  • CA Creation Fix - Fixed crash with null validity/keySize values on Docker
  • DN Validation - Country code auto-uppercased, CSR validation added
  • Docker Path Unified - All data in /opt/ucm/data (same as DEB/RPM)
  • Migration Support - Auto-migrate from old Docker path on upgrade

Read Full Release Notes

v2.0.0 ✅ STABLE

  • Complete UI Redesign - New React 18 frontend with Radix UI
  • 12 Theme Variants - 6 color themes × Light/Dark modes
  • Enhanced Dashboard - Real-time stats, charts, activity feed
  • Certificate Toolbox - SSL checker, decoders, key matcher, converter
  • User Groups - Organize users with permissions
  • Certificate Templates - Predefined configurations
  • Trust Store - Manage trusted root CAs
  • Audit Trail - Complete action logging with hash chain verification
  • Password Security - Strength indicator, forgot password flow
  • Session Management - Timeout warning, force password change
  • API v2 - RESTful JSON API with OpenAPI docs
  • Docker Hub - Now available on Docker Hub
  • Auto-migration - Seamless upgrade from v1.8.x

Read Full Release Notes

v1.8.3 ✅ STABLE

  • Nginx Dependency Fixed
    • Nginx is now truly optional
    • UCM can run standalone with built-in HTTPS server
    • Fixed GitHub Actions workflow packaging bug
  • Deployment Flexibility
    • Standalone mode (no reverse proxy needed)
    • Reverse proxy mode (nginx/apache)
    • Docker deployment
  • Documentation Updates
    • All guides updated to v1.8.3
    • CHANGELOG with full history
    • Clear deployment options

Read Full Release Notes

v1.8.3

  • ✅ Export Authentication - All formats (PEM, DER, PKCS#12) with JWT
  • Visual Theme Previews - 2×4 grid with live previews
  • Docker/Native Compatibility - Dynamic path resolution
  • Global PKCS#12 Modal - Available across all pages

Read Release Notes

v1.7.5

  • Dependency Updates (Python 3.13 compatible)
  • Security: cryptography 46.0.3, pyOpenSSL 25.3.0
  • WebAuthn: Updated to 2.7.0 with FIDO2 improvements
  • Bug Fixes: Certificate selector, Dockerfile improvements

v1.7.0

  • Collapsible sidebar submenus with smooth animations
  • My Account section relocated to bottom of sidebar
  • Optimized sidebar width (220px uniform across all themes)
  • 14×14px submenu icons for better visual hierarchy
  • localStorage persistence for submenu states

v1.6.2

  • Fixed OPNsense import JavaScript errors
  • Fixed import statistics display
  • Improved toast notification system

v1.6.0

  • Complete Tailwind CSS removal (~827 classes)
  • Custom themed scrollbars
  • CRL Information pages (public & integrated)
  • Modal system improvements
  • Full responsive design
  • 8 beautiful themes

See Full Changelog

📊 System Information

Property Value
Latest Stable 2.69
Previous Stable 2.68
Python 3.10+ (3.13 compatible)
Platform Linux, Docker (multi-arch)
License BSD-3-Clause
Repository GitHub
Docker Registry GHCR

🎯 Additional Resources

💡 Need Help?

Last Updated: 2025-07-22
Maintained By: NeySlim

Clone this wiki locally