NeySlim/ultimate-ca-manager v2.203-rc1

on GitHub

[2.202] - 2026-07-22

Fixed

• Security keys stopped working after upgrading to 2.200 — signature-counter clone detection began being enforced against a stored value that earlier releases had incremented on every login, including for the many authenticators (platform passkeys, and most FIDO2 keys) that always report a counter of zero. Those users could never present a value high enough and were locked out of their own key with Authentication failed. Clone detection is now only applied when the authenticator actually maintains a counter, and the inflated stored values are reset once on upgrade (migration 065); a genuine counter that fails to increase is still refused.
• Test runs no longer write to the production log — the suite inherited the native logging configuration and appended to /var/log/ucm/ucm.log. On a host that also runs UCM this polluted real logs and, when the suite ran as a different user, took ownership of the file at rotation — after which the service could no longer write its own log at all.
• Access log was never written — the WebSocket-capable Gunicorn worker bypassed Gunicorn's access logger entirely, so /var/log/ucm/access.log stayed empty on every native install no matter how many requests were served. This made it impossible to tell whether a protocol client (SCEP/EST/ACME) had even reached the server when troubleshooting. Requests are logged again.
• EST and TSA configuration refusals are now logged — same gap as SCEP: an unknown EST label, an unconfigured EST CA, a disabled TSA, and a TSA CA that is missing or has no certificate/key all returned an error to the client without recording anything. Contributed by @Hemsby (#224).
• SCEP configuration refusals are now logged — a request that reached the server and was turned away by a configuration check (CA offline, no private key, HSM-backed CA, no CA assigned) returned a 500 without recording anything, which was indistinguishable in the log from a request that never arrived. Each refusal now names its reason and the CA involved. Reported by @Hemsby.
• Inbound SCEP requests are now logged — only failures were recorded, so a silent log was ambiguous between "the device never reached us" and "it reached us and succeeded". Each request now logs its operation, HTTP method, source address and client User-Agent.

[2.201] - 2026-07-22

Security

• Group permissions are now enforced — Group.permissions was stored and editable but never consulted by authorization, so every grant made through a group was silently inert. A user's effective permissions are now their role's unioned with those of their groups, and the login response advertises the same set the API enforces. Groups can only grant permissions that are actually enforced (the previous list offered read:certs while endpoints require read:certificates) and can never grant admin:* or the * wildcard, so group membership is not a path to administrator. Permissions outside that set are ignored on read as well as on write, so a value introduced by an old backup or direct SQL stays inert.
• SCEP challenge passwords now expire — scep_challenge_validity was validated and stored but never applied, leaving a leaked challenge usable indefinitely. The challenge generation time is recorded and enrollment is refused once the configured window has passed. An expired challenge is an explicit refusal rather than a fall-through to the weaker no-challenge path, and renewals keep working since they authenticate with the existing certificate. Challenges created before this release are adopted on first use rather than expired on the spot, so upgrading does not lock out a deployed fleet. The challenge API now reports expired and expires_at.

Added

• EST CA labels (RFC 7030 §3.2.2) — EST operations are now also served under /.well-known/est/<label>/…, letting one deployment expose several CAs. Opt-in: map labels to CAs in the est_labels system setting (JSON, label → CA reference); with none configured only the existing unlabelled endpoints exist and behaviour is unchanged. An unknown label returns 404 and never falls back to the default CA, so a client is never enrolled against an authority it did not address.
• RFC 7807 problem details on API errors — error responses now carry the standard type, title, status, detail and instance members and are served as application/problem+json. Not a breaking change: the historical error, message and code keys are still present alongside them, so existing API clients and integrations keep working unchanged. Authentication, permission and unrouted-path errors follow the same shape as handler errors.
• ACME certificate profiles (draft-ietf-acme-profiles) — the directory can advertise named issuance profiles under meta.profiles, and clients select one with the profile field in newOrder; the selected profile drives the issued certificate's validity and signature digest, and is echoed on the order. Opt-in: configure the acme_profiles system setting (a JSON map of name → description/validity_days/digest); with none configured the directory advertises no profiles and behaviour is unchanged. An unknown or malformed profile is rejected with invalidProfile (migration 064).

Full history: CHANGELOG.md