NeySlim/ultimate-ca-manager v2.202-rc1

on GitHub

[2.201] - 2026-07-22

Security

• Group permissions are now enforced — Group.permissions was stored and editable but never consulted by authorization, so every grant made through a group was silently inert. A user's effective permissions are now their role's unioned with those of their groups, and the login response advertises the same set the API enforces. Groups can only grant permissions that are actually enforced (the previous list offered read:certs while endpoints require read:certificates) and can never grant admin:* or the * wildcard, so group membership is not a path to administrator. Permissions outside that set are ignored on read as well as on write, so a value introduced by an old backup or direct SQL stays inert.
• SCEP challenge passwords now expire — scep_challenge_validity was validated and stored but never applied, leaving a leaked challenge usable indefinitely. The challenge generation time is recorded and enrollment is refused once the configured window has passed. An expired challenge is an explicit refusal rather than a fall-through to the weaker no-challenge path, and renewals keep working since they authenticate with the existing certificate. Challenges created before this release are adopted on first use rather than expired on the spot, so upgrading does not lock out a deployed fleet. The challenge API now reports expired and expires_at.

Added

• EST CA labels (RFC 7030 §3.2.2) — EST operations are now also served under /.well-known/est/<label>/…, letting one deployment expose several CAs. Opt-in: map labels to CAs in the est_labels system setting (JSON, label → CA reference); with none configured only the existing unlabelled endpoints exist and behaviour is unchanged. An unknown label returns 404 and never falls back to the default CA, so a client is never enrolled against an authority it did not address.
• RFC 7807 problem details on API errors — error responses now carry the standard type, title, status, detail and instance members and are served as application/problem+json. Not a breaking change: the historical error, message and code keys are still present alongside them, so existing API clients and integrations keep working unchanged. Authentication, permission and unrouted-path errors follow the same shape as handler errors.
• ACME certificate profiles (draft-ietf-acme-profiles) — the directory can advertise named issuance profiles under meta.profiles, and clients select one with the profile field in newOrder; the selected profile drives the issued certificate's validity and signature digest, and is echoed on the order. Opt-in: configure the acme_profiles system setting (a JSON map of name → description/validity_days/digest); with none configured the directory advertises no profiles and behaviour is unchanged. An unknown or malformed profile is rejected with invalidProfile (migration 064).

[2.200] - 2026-07-21

Added

• ACME client protocol coverage — upstream certificate revocation through the proxy (previously answered 501), ARI consumption (RFC 9773: suggested renewal windows and the replaces field on renewal orders), TLS-ALPN-01 challenge support (RFC 8737) and IP identifiers (RFC 8738).
• ACME server conformance (RFC 8555) — registered error types (badNonce, badRevocationReason, caa…), full order/authorization state machine (processing, expired, authorization failures propagate to the order), subproblem documents (§6.7.1), contact validation (unsupportedContact/invalidContact), error field exposed on orders, EAB protected.url verification, application/jose+json content type, ARI replaces tracking (migration 063).
• SCEP (RFC 8894) — GetCert and GetCRL operations, mandatory 16-byte senderNonce, intermediate chain in GetCACert (degenerate PKCS#7), signingTime validation, signed GetNextCACert, AES-128-CBC encryption, PasswordRecipientInfo with PBKDF2 for non-RSA clients, strict SignerInfo/RecipientInfo/eContentType validation.
• OCSP (RFC 6960) — multi-certificate requests (§4.1.1), unknown critical request extensions answered with malformedRequest, delegated responder validation (issued by the CA, within validity, OCSPSigning EKU), configurable response validity window.
• CAA (RFC 8657/8659) — accounturi and validationmethods parameters enforced during ACME issuance, fail-closed on critical flags and on DNS failures (SERVFAIL/timeout), iodef reports logged.
• EST (RFC 7030) — strict application/pkcs10 content type, certs-only responses (smime-type=certs-only), subject+SAN comparison on re-enroll, unauthenticated /csrattrs, spec-conformant server-side key generation (CMS EnvelopedData §4.4).
• TSA (RFC 3161) — reqPolicy validation (unacceptedPolicy on mismatch), signer EKU timeStamping verification, hash algorithm aligned with the message imprint, per-token audit.
• Certificate Transparency (RFC 6962) — pre-certificate submission flow (add-pre-chain) with the SCT list embedded as an X.509 extension in the issued certificate (opt-in ct_embed_sct, with ct_required enforcement).
• Misc protocol hardening — syslog RFC 6587 octet-counting framing with TLS verify option, WebAuthn authenticator clone detection (signature counter), SSH CA allowed-principals patterns (fnmatch) with CA/cert type checks, Kerberos PKINIT EKU in the EKU catalog, RFC 4514 LDAP DN parsing.

Security

• OCSP cache invalidated on revocation — revoking a certificate now purges every cached OCSP response for it (per-algorithm cache entries were missed), so revoked certificates stop being reported good immediately (RFC 6960 §2.2). Nonced responses are no longer cached, and lookups are scoped to the issuing CA to prevent cross-CA serial collisions.
• ACME POST-as-GET enforced — orders, authorizations and certificates now require a signed JWS request; they were previously readable without authentication (renewalInfo stays public per RFC 9773).
• OIDC SSO id_token verification — signature, issuer, audience, expiry and nonce are now validated against the provider's JWKS (discovery with key caching, fail-closed; migration 062). Upgrade note: verification defaults to on; existing OIDC providers must have their issuer (and JWKS URI, or a discoverable issuer) configured in Settings → SSO, otherwise OIDC logins fail closed with "OIDC issuer is not configured" until set. Verification can be turned off per provider if needed.
• Name constraints enforced on every issuance path — the subject and SANs are validated against the NameConstraints of the whole CA chain (not just the direct issuer) on web, ACME, EST, SCEP, renewal and approval-policy issuance; unauthorized CSR extensions are filtered from issued certificates.
• Delegated-authority EKUs restricted for protocol enrollees — certificates issued from a CSR via ACME/EST/SCEP can no longer carry id-kp-OCSPSigning or id-kp-timeStamping, which would otherwise let a domain-validated client mint an OCSP delegated responder for the whole CA.
• SCEP GetNextCACert response is now signed as required by RFC 8894.
• Certificate Transparency policy applied on all issuance paths — SCT embedding and the ct_required gate now apply to ACME- and EST-issued certificates, not only the web issuance path.

Fixed

• ACME pre-authorization (RFC 8555 §7.4.1) crashed when validating a challenge on an authorization not bound to an order.
• ACME wildcard orders kept the *. prefix in the authorization identifier and omitted the wildcard: true flag.
• CRL scheduler used delta CRL metadata to decide full-CRL regeneration timing.
• Microsoft AD CS: admin channel test now uses the form's unsaved values — changing e.g. the WinRM transport no longer requires saving before testing, and a test never persists anything.
• Microsoft AD CS: inventory sync no longer duplicates certificates signed through UCM — deduplication matches the CA's RequestId and compares serial numbers under both byte orders (certutil reports serials with reversed byte pairs).
• Microsoft AD CS: imported certificates can now be renewed — when the original CSR/key is not in UCM, renewal generates a fresh key pair and a CSR with the same subject and SANs (rekey) and submits it to the issuing connection; a "No Key" badge on the certificate detail makes key-less imports explicit.
• SSH host CA setup script printed an API signing example with a nonexistent endpoint and the CA name where its id belongs.

Full history: CHANGELOG.md