NeySlim/ultimate-ca-manager v2.177 on GitHub

What's Changed

Fixed

HSM-backed CA certificate issuance — issuing, renewing, bulk-reissuing, or approval-flow issuing a certificate against an HSM-backed CA (Vault Transit / OpenBao / PKCS#11 / Azure Key Vault / GCP KMS) no longer fails with CA private key not available. Every certificate-issuance path now goes through the HSM-aware get_ca_signing_key loader instead of reading the local ca.prv column (which is empty for HSM CAs), and gates on has_private_key rather than on ca.prv (#142).
EST and auto-renewal signing — sign_csr_from_crypto (the EST enrollment and automatic-renewal signing path) was loading the CA key directly from ca.prv and crashed on HSM-backed CAs; it now routes through the same HSM key loader as the rest of the codebase (#142).
SCEP with HSM-backed CAs — the SCEP factory no longer crashes when the configured CA is HSM-backed. SCEP requires RSA envelope decryption (RFC 8894 §3.4), which is not available for HSM-resident keys, so the service now returns a clear SCEP is not supported for HSM-backed CAs error at configuration time instead of failing opaquely at runtime (#142).

Changed

Dead code removed — the unused CAOperationsMixin.generate_crl implementation (all callers use CRLService.generate_crl, which is already HSM-aware) and the orphaned get_ca_private_key_pem helper have been removed.

📜 Recent release history (last 2 versions)

[2.176] - 2026-06-18

Added

Forced 2FA enrolment — local and SSO logins can be required to enrol a TOTP authenticator before the session is fully usable. A restricted session is established until enrolment is complete (only the 2FA enrolment and logout endpoints are reachable). Global enforcement is a single Enforce Two-Factor Authentication toggle for local accounts; each SSO provider has its own enforce_2fa switch, independent of the global one. Individual users can be exempted (e.g., a break-glass admin). mTLS and WebAuthn logins are never additionally forced, since they are already a strong second factor (#141).

[2.175] - 2026-06-17

Fixed

Manual DNS-01 is usable again — the ACME client no longer waits a fixed 10s then auto-submits. For a Manual DNS provider the order stays pending so you can add the TXT record and click Verify Challenge (which self-checks DNS before submitting, so it never burns the token; a force option bypasses the check). For automated providers the client self-checks propagation (configurable DNS propagation timeout in ACME → Let's Encrypt settings) and runs validation in the background so the request never blocks (#140).

Fixed

Duplicate webhook notifications — certificate.expiring (and other events) could be delivered twice with an identical payload while the delivery log showed a single event. Webhook deliveries are now claimed atomically (exactly-once) and the background scheduler runs in a single process, so each delivery is sent once even under concurrent workers (#139).

Security

Updated cryptography to 48.0.1 (GHSA-537c-gmf6-5ccf, vulnerable OpenSSL in wheels) and forced ws to 8.21.0 (CVE-2026-48779, WebSocket DoS).

Full history: CHANGELOG.md

Installation

Docker (Recommended)

# From Docker Hub
docker pull neyslim/ultimate-ca-manager:2.177

# Or from GitHub Container Registry
docker pull ghcr.io/neyslim/ultimate-ca-manager:2.177

# Run
docker run -d -p 8443:8443 \
  -e SECRET_KEY=$(openssl rand -hex 32) \
  --name ucm neyslim/ultimate-ca-manager:2.177

Debian/Ubuntu

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.177/ucm_2.177_all.deb
sudo dpkg -i ucm_2.177_all.deb
sudo apt-get install -f

Fedora/RHEL

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.177/ucm-2.177-1.fc43.noarch.rpm
sudo dnf install ./ucm-2.177-1.fc43.noarch.rpm

Silent/Automated Install

# Skip firewall prompts for CI/automation
sudo UCM_PORT=8443 UCM_FIREWALL=no dpkg -i ucm_2.177_all.deb

Default Credentials

Username: admin
Password: changeme123

Change the password immediately after first login!

Documentation

Installation Guide
API Documentation