NeySlim/ultimate-ca-manager v2.178 on GitHub

What's Changed

Fixed

OCSP responder now echoes the request CertID hash algorithm — the OCSP responder previously always built the SingleResponse CertID with SHA-256, regardless of the hash algorithm used in the request. Strict RFC 6960 clients (notably Cisco ASA) send a SHA-1 CertID and reject a response whose CertID they cannot match back to their request, causing OCSP validation to fail despite a valid good status. The responder now uses the request's hash algorithm (SHA-1, SHA-256, SHA-384, SHA-512) and recomputes the issuer name/key hashes accordingly, and the response cache is keyed per hash algorithm to avoid cross-algorithm cache collisions (#143).

📜 Recent release history (last 2 versions)

[2.177] - 2026-06-21

Fixed

HSM-backed CA certificate issuance — issuing, renewing, bulk-reissuing, or approval-flow issuing a certificate against an HSM-backed CA (Vault Transit / OpenBao / PKCS#11 / Azure Key Vault / GCP KMS) no longer fails with CA private key not available. Every certificate-issuance path now goes through the HSM-aware get_ca_signing_key loader instead of reading the local ca.prv column (which is empty for HSM CAs), and gates on has_private_key rather than on ca.prv (#142).
EST and auto-renewal signing — sign_csr_from_crypto (the EST enrollment and automatic-renewal signing path) was loading the CA key directly from ca.prv and crashed on HSM-backed CAs; it now routes through the same HSM key loader as the rest of the codebase (#142).
SCEP with HSM-backed CAs — the SCEP factory no longer crashes when the configured CA is HSM-backed. SCEP requires RSA envelope decryption (RFC 8894 §3.4), which is not available for HSM-resident keys, so the service now returns a clear SCEP is not supported for HSM-backed CAs error at configuration time instead of failing opaquely at runtime (#142).

Changed

Dead code removed — the unused CAOperationsMixin.generate_crl implementation (all callers use CRLService.generate_crl, which is already HSM-aware) and the orphaned get_ca_private_key_pem helper have been removed.

[2.176] - 2026-06-18

Added

Forced 2FA enrolment — local and SSO logins can be required to enrol a TOTP authenticator before the session is fully usable. A restricted session is established until enrolment is complete (only the 2FA enrolment and logout endpoints are reachable). Global enforcement is a single Enforce Two-Factor Authentication toggle for local accounts; each SSO provider has its own enforce_2fa switch, independent of the global one. Individual users can be exempted (e.g., a break-glass admin). mTLS and WebAuthn logins are never additionally forced, since they are already a strong second factor (#141).

Full history: CHANGELOG.md

Installation

Docker (Recommended)

# From Docker Hub
docker pull neyslim/ultimate-ca-manager:2.178

# Or from GitHub Container Registry
docker pull ghcr.io/neyslim/ultimate-ca-manager:2.178

# Run
docker run -d -p 8443:8443 \
  -e SECRET_KEY=$(openssl rand -hex 32) \
  --name ucm neyslim/ultimate-ca-manager:2.178

Debian/Ubuntu

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.178/ucm_2.178_all.deb
sudo dpkg -i ucm_2.178_all.deb
sudo apt-get install -f

Fedora/RHEL

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.178/ucm-2.178-1.fc43.noarch.rpm
sudo dnf install ./ucm-2.178-1.fc43.noarch.rpm

Silent/Automated Install

# Skip firewall prompts for CI/automation
sudo UCM_PORT=8443 UCM_FIREWALL=no dpkg -i ucm_2.178_all.deb

Default Credentials

Username: admin
Password: changeme123

Change the password immediately after first login!

Documentation

Installation Guide
API Documentation