NeySlim/ultimate-ca-manager v2.190

on GitHub

[2.189] - 2026-07-09

Added

• ACME LOT A — shared DNS self-check for proxy and renewal — the ACME proxy and auto-renewal paths no longer use a blind fixed 30s sleep after publishing the DNS-01 TXT record. Both now poll actively via services/acme/dns_selfcheck.py, honouring acme.client.dns_propagation_timeout (same setting as the ACME client auto-poll). If the TXT is still missing when the timeout elapses, the proxy skips upstream challenge submission and marks the challenge dns_not_ready instead of burning the token on the upstream CA. Renewal cleans up DNS TXT records on propagation or finalization failure.
• ACME renewal partial TXT cleanup — multi-domain renewals now mark DNS TXT records for cleanup as soon as the first create_txt_record succeeds, so a failure on a later domain no longer leaves earlier TXT records behind.
• GUI toggle: verbose ACME/DNS diagnostics — ACME → Let's Encrypt → Verbose ACME/DNS logs (acme.client.debug_logging) promotes DNS resolver diagnostics (poll ticks, per-resolver failures, lookup source) from DEBUG to INFO for troubleshooting propagation issues without raising the global log level. The flag is memoized per app context, so hot poll loops do not query the database per log line. Default off.

Changed

• ACME client DNS self-check refactor — _dns_selfcheck / timeout reading in orders.py now delegate to the shared dns_selfcheck module used by proxy and renewal, keeping one implementation for poll interval, logging, and timeout semantics.

Fixed

• AD CS Kerberos authentication crashed on a missing unused dependency — the kerberos auth mode built the certsrv client in NTLM mode before attaching the Kerberos handler, which made the certsrv library import requests_ntlm even though it was never used. Every Test Connection / sign in kerberos mode failed with "No module named 'requests_ntlm'". The client is now built with a neutral placeholder auth and the Kerberos handler attached directly; all three auth modes (basic, certificate/mTLS, kerberos) smoke-tested end-to-end against a Windows Server 2025 AD CS.

[2.188] - 2026-07-08

Security

• DNS provider credentials encrypted at rest (GHSA-38cv-3c4g-w55w) — DNS-01 provider API keys/tokens (Cloudflare, Route53, …) were stored as plaintext JSON in dns_providers.credentials despite the column being labelled encrypted, so anyone with database read access (or a raw export of the field) obtained domain-control credentials. The field is now encrypted at rest via a model property (utils.encryption Fernet, mirroring the EAB HMAC key), read paths transparently decrypt (legacy plaintext rows still read), and migration 052 encrypts any pre-existing rows. Backup export/restore round-trips the decrypted value so cross-machine restore keeps working; regression tested (round-trip, at-rest ciphertext, constructor/restore path, migration idempotency). Reported externally by Ralph.
• Dev-dependency advisories — bumped transitive build/lint tooling out of vulnerable ranges via npm overrides: js-yaml → 4.3.0 (GHSA-h67p-54hq-rp68, quadratic-complexity DoS in merge-key handling; pulled in by eslint) and @babel/core → 7.29.7 (GHSA-4x5r-pxfx-6jf8, arbitrary file read via sourceMappingURL; pulled in by @vitejs/plugin-react). Both are build-time only and never shipped in the runtime bundle.

Full history: CHANGELOG.md