NeySlim/ultimate-ca-manager v2.203

on GitHub

What's Changed

Fixed

• TSA works again for existing installations — 2.200 required the timestamp signer to carry a critical, exclusive timeStamping EKU, but the signer is the configured CA's own certificate, which carries no EKU at all: every deployment that timestamped before the upgrade got a 503 on all requests, and the product offered no way to mint a compliant signer. A CA certificate is accepted again (with a recommendation to use a dedicated TSA certificate), the new tsa_enabled gate no longer refuses installs that configured a TSA CA before the flag existed, and a client-pinned reqPolicy is honored by issuing under that policy (RFC 3161 §2.4.1) instead of rejecting.
• ACME issuance no longer fails closed on CAA DNS errors — 2.200 turned any CAA lookup failure (SERVFAIL, timeout, unreachable resolver) into a denial and terminally invalidated the order, which broke every renewal on air-gapped and split-horizon networks. DNS errors are non-blocking again by default (a warning is logged); strict fail-closed behaviour is available with the new "fail issuance on DNS lookup errors" toggle, and a transient DNS error never invalidates the order anymore. An RFC 8657 validationmethods parameter is no longer enforced when the validation method is indeterminable (reused or auto-approved authorizations).
• Renewals are no longer blocked by CA name constraints — 2.200 started validating renewals against the chain's NameConstraints, so certificates legitimately issued before enforcement (or before constraints were tightened) became un-renewable and fleets stranded at expiry; scheduled auto-renewal even swallowed the failure silently. Renewal-at-par now graces the names a certificate already carries (single, bulk, scheduled, SCEP and EST renewals) — only names new to the request are enforced — and auto-renewal failures are recorded in the audit trail. A CN that is not hostname-shaped (e.g. a person's name) is no longer treated as a DNS identity, and an unparseable NameConstraints extension no longer blocks all issuance from that CA.
• SCEP accepts legacy clients again — 2.200 required a 16-byte senderNonce and an in-window signingTime, and matched the RecipientInfo byte-for-byte against the CA certificate, which rejected fleets of already-enrolled devices (pre-RFC clients, devices without NTP, embedded stacks that re-encode the issuer). All three checks are tolerant again by default (warnings are logged); signingTime enforcement and its clock-skew window are configurable. GetCACert on an intermediate CA returns the single CA certificate again — the application/x-x509-ca-ra-cert chain response broke Apple/MDM enrollment (error -67731) — with the full-chain response available as an option. A renewal no longer silently strips EKUs the device's current certificate already carries.
• EST accepts legacy integrations again — 2.200 returned 415 unless the request carried Content-Type: application/pkcs10 (breaking plain curl scripts) and refused PEM-encoded CSR bodies; both are accepted again with a deprecation warning. Re-enrollment no longer rejects a CSR whose SubjectAltName entries are reordered or differ only in criticality, and a CSR without SAN is issued as before. Clients that need the CA chain in the enroll response (instead of /cacerts) can opt in.
• Syslog forwarding keeps line framing on upgrade — 2.200 silently switched TCP+TLS syslog to RFC 6587 octet-counting, corrupting the stream for collectors that only speak newline framing, with no way back from the UI. Existing configurations are pinned to line framing on upgrade (migration 066) and the framing is now an explicit setting.
• Revoked certificates can no longer answer good from the OCSP cache after upgrade — cache entries written before 2.200 (whose revocation-invalidation was broken) are purged once at upgrade (migration 066).
• Wildcard ACME authorizations created before 2.200 are reusable again — they were stored in a format the new reuse lookup never matched, forcing a dns-01 re-validation on the first renewal (fatal with certbot --manual). Existing rows are normalized at upgrade (migration 067).
• UCM-managed ACME renewals recover when the upstream rejects replaces — the RFC 9773 renewal hint is retried without the field on rejection instead of failing every renewal cycle until expiry.
• A failed MS CA rekey submission no longer leaves the certificate paired with the wrong key — the freshly generated key/CSR are rolled back when the submission errors or is denied, so a PKCS#12 export cannot bundle a key that never got signed.
• Admin Sign-CSR can issue delegated OCSP responder and TSA certificates again — 2.200 silently stripped the OCSPSigning/timeStamping EKUs on every path, including the operator explicitly signing a responder's CSR; the strip now applies only to protocol enrollees (ACME/EST), is logged, and can no longer be smuggled back in through the extra-EKUs merge.
• OIDC provider settings are fully configurable in the UI — 2.200 enabled ID-token verification by default but the issuer, JWKS URI and verification toggle it relies on were never exposed, so existing OIDC providers failed closed with no way to fix them without manual API calls (#227).

Added

• Settings previously configurable only by direct database edits now have UI and API coverage: Certificate Transparency SCT embedding and the require-SCTs policy (with an updated default log list), OCSP response validity window, CAA issuer identifiers and enforcement mode, SCEP signingTime enforcement/clock skew/GetCACert chain, EST chain-in-response, syslog TLS verification and TCP framing, and the ACME client's TLS-ALPN-01 port. TLS-ALPN-01 (RFC 8737) is selectable when requesting certificates through the ACME client.
• Templates now govern the issued certificate's Key Usage and Extended Key Usage — issuing from a template previously ignored its configured KU/EKU entirely: the certificate type's built-in profile was applied instead and its EKUs were always merged in, so a template restricted to OCSPSigning still produced a certificate carrying serverAuth. When a template is selected its extensions_template is now the source of truth (extra EKUs are still added on top), and the certificate type selector in the issue form is disabled since the template defines it. Reported in #226.
• Changing a template's type now updates its Key Usage / Extended Key Usage checkboxes — the type selector previously changed nothing in the form, so every new template started from the web-server defaults regardless of the chosen type. Reported in #226.

Added

• custom certificate type at issuance — imposes no Extended Key Usage: only the EKUs you pick end up in the certificate, and with none selected the EKU extension is omitted entirely. This makes single-purpose certificates (e.g. an OCSP responder with only OCSPSigning) possible from the issue form. Requested in #226.
• OCSP Signing system template (ocsp_signing type) — delegated OCSP responder profile (RFC 6960): digitalSignature + OCSPSigning only, 90-day validity. Existing installations receive it automatically on upgrade. OCSPSigning is also selectable in the template editor's EKU checkboxes. Requested in #226.

Installation

Docker (Recommended)

# From Docker Hub
docker pull neyslim/ultimate-ca-manager:2.203

# Or from GitHub Container Registry
docker pull ghcr.io/neyslim/ultimate-ca-manager:2.203

# Run
docker run -d -p 8443:8443 \
  -e SECRET_KEY=$(openssl rand -hex 32) \
  --name ucm neyslim/ultimate-ca-manager:2.203

Debian/Ubuntu

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.203/ucm_2.203_all.deb
sudo dpkg -i ucm_2.203_all.deb
sudo apt-get install -f

Fedora/RHEL

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.203/ucm-2.203-1.fc43.noarch.rpm
sudo dnf install ./ucm-2.203-1.fc43.noarch.rpm

Silent/Automated Install

# Skip firewall prompts for CI/automation
sudo UCM_PORT=8443 UCM_FIREWALL=no dpkg -i ucm_2.203_all.deb

Default Credentials

• Username: admin
• Password: changeme123

Change the password immediately after first login!

Documentation

• Installation Guide
• API Documentation