NeySlim/ultimate-ca-manager v2.191-rc1

on GitHub

[2.190] - 2026-07-10

Fixed

• API-key creation rejected valid permission resources — the permission validator in POST /api/v2/account/apikeys used a hardcoded resource list that had drifted from the scopes actually enforced by the API: keys could not be scoped to csrs, user_certificates, templates, truststore, est, hsm, ssh, policies, approvals, key_recovery, audit, groups or sso (e.g. write:csrs, required to sign a CSR, was rejected — leaving CSR signing reachable only with a full-access * key). The valid set is now derived from ROLE_PERMISSIONS plus the admin-only resources (users, system, sso), with a regression test that scans every @require_auth scope so the validator can no longer drift. Contributed by @heidrickla (#178).

[2.189] - 2026-07-09

Added

• ACME LOT A — shared DNS self-check for proxy and renewal — the ACME proxy and auto-renewal paths no longer use a blind fixed 30s sleep after publishing the DNS-01 TXT record. Both now poll actively via services/acme/dns_selfcheck.py, honouring acme.client.dns_propagation_timeout (same setting as the ACME client auto-poll). If the TXT is still missing when the timeout elapses, the proxy skips upstream challenge submission and marks the challenge dns_not_ready instead of burning the token on the upstream CA. Renewal cleans up DNS TXT records on propagation or finalization failure.
• ACME renewal partial TXT cleanup — multi-domain renewals now mark DNS TXT records for cleanup as soon as the first create_txt_record succeeds, so a failure on a later domain no longer leaves earlier TXT records behind.
• GUI toggle: verbose ACME/DNS diagnostics — ACME → Let's Encrypt → Verbose ACME/DNS logs (acme.client.debug_logging) promotes DNS resolver diagnostics (poll ticks, per-resolver failures, lookup source) from DEBUG to INFO for troubleshooting propagation issues without raising the global log level. The flag is memoized per app context, so hot poll loops do not query the database per log line. Default off.

Changed

• ACME client DNS self-check refactor — _dns_selfcheck / timeout reading in orders.py now delegate to the shared dns_selfcheck module used by proxy and renewal, keeping one implementation for poll interval, logging, and timeout semantics.

Fixed

• AD CS Kerberos authentication crashed on a missing unused dependency — the kerberos auth mode built the certsrv client in NTLM mode before attaching the Kerberos handler, which made the certsrv library import requests_ntlm even though it was never used. Every Test Connection / sign in kerberos mode failed with "No module named 'requests_ntlm'". The client is now built with a neutral placeholder auth and the Kerberos handler attached directly; all three auth modes (basic, certificate/mTLS, kerberos) smoke-tested end-to-end against a Windows Server 2025 AD CS.

Full history: CHANGELOG.md