NeySlim/ultimate-ca-manager v2.179 on GitHub

What's Changed

Fixed

Dashboard could not be scrolled on smaller desktop viewports — on laptops where the sidebar narrowed the grid below the large breakpoint, the dashboard rendered a non-scrollable multi-row grid clipped inside a fixed-height container, so the lower widgets (Recent Activity, System Health, ACME Accounts, Trust Store) were unreachable. The grid container now scrolls vertically when the layout overflows instead of being clipped (#144).
Certificate linting no longer spawns a cascade of error toasts — the conformance-lint modal (CertificateLintModal) retriggered its own fetch in a loop whenever a lint call failed, because the toast-dispatch callbacks it depended on were recreated on every render. Toast / notification callbacks are now stable, and the modal guards against concurrent lint calls, so a failed lint surfaces a single error instead of an unbounded stack (#145).

Added

Downloadable diagnostic log bundle — Settings → About → Diagnostic exposes an admin-only button that downloads a ZIP of the most relevant logs (ucm.log, error.log, access.log, the last lines of the systemd journal when available) plus a short secret-free system diagnostic (version, DB backend, migration number, services status). Sensitive tokens (Bearer credentials, passwords, API tokens, JWTs, PEM private-key blocks) are redacted before packaging, and each log file is capped so the bundle stays lightweight.

📜 Recent release history (last 2 versions)

[2.178] - 2026-06-23

Fixed

OCSP responder now echoes the request CertID hash algorithm — the OCSP responder previously always built the SingleResponse CertID with SHA-256, regardless of the hash algorithm used in the request. Strict RFC 6960 clients (notably Cisco ASA) send a SHA-1 CertID and reject a response whose CertID they cannot match back to their request, causing OCSP validation to fail despite a valid good status. The responder now uses the request's hash algorithm (SHA-1, SHA-256, SHA-384, SHA-512) and recomputes the issuer name/key hashes accordingly, and the response cache is keyed per hash algorithm to avoid cross-algorithm cache collisions (#143).

[2.177] - 2026-06-21

Fixed

HSM-backed CA certificate issuance — issuing, renewing, bulk-reissuing, or approval-flow issuing a certificate against an HSM-backed CA (Vault Transit / OpenBao / PKCS#11 / Azure Key Vault / GCP KMS) no longer fails with CA private key not available. Every certificate-issuance path now goes through the HSM-aware get_ca_signing_key loader instead of reading the local ca.prv column (which is empty for HSM CAs), and gates on has_private_key rather than on ca.prv (#142).
EST and auto-renewal signing — sign_csr_from_crypto (the EST enrollment and automatic-renewal signing path) was loading the CA key directly from ca.prv and crashed on HSM-backed CAs; it now routes through the same HSM key loader as the rest of the codebase (#142).
SCEP with HSM-backed CAs — the SCEP factory no longer crashes when the configured CA is HSM-backed. SCEP requires RSA envelope decryption (RFC 8894 §3.4), which is not available for HSM-resident keys, so the service now returns a clear SCEP is not supported for HSM-backed CAs error at configuration time instead of failing opaquely at runtime (#142).

Changed

Dead code removed — the unused CAOperationsMixin.generate_crl implementation (all callers use CRLService.generate_crl, which is already HSM-aware) and the orphaned get_ca_private_key_pem helper have been removed.

Full history: CHANGELOG.md

Installation

Docker (Recommended)

# From Docker Hub
docker pull neyslim/ultimate-ca-manager:2.179

# Or from GitHub Container Registry
docker pull ghcr.io/neyslim/ultimate-ca-manager:2.179

# Run
docker run -d -p 8443:8443 \
  -e SECRET_KEY=$(openssl rand -hex 32) \
  --name ucm neyslim/ultimate-ca-manager:2.179

Debian/Ubuntu

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.179/ucm_2.179_all.deb
sudo dpkg -i ucm_2.179_all.deb
sudo apt-get install -f

Fedora/RHEL

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.179/ucm-2.179-1.fc43.noarch.rpm
sudo dnf install ./ucm-2.179-1.fc43.noarch.rpm

Silent/Automated Install

# Skip firewall prompts for CI/automation
sudo UCM_PORT=8443 UCM_FIREWALL=no dpkg -i ucm_2.179_all.deb

Default Credentials

Username: admin
Password: changeme123

Change the password immediately after first login!

Documentation

Installation Guide
API Documentation