NeySlim/ultimate-ca-manager v2.220-rc1

on GitHub

[2.219] - 2026-09-01

Fixed

• Local ACME accounts created from the admin UI now store their contact e-mail in the RFC 8555 format, so the address shows up in the accounts list and detail panel instead of a bare "Account #N"; accounts created before this fix keep displaying their address through a legacy-format fallback, and editing the e-mail also normalizes the stored value
• The 2.218 ACME and HTTPS quality-of-life additions are now actually discoverable: the account e-mail edit is a labeled button spanning the detail grid (it rendered as a cryptic icon squeezed against the address), the client orders got their own "Let's Encrypt orders" sidebar tab mirroring Local orders (the in-section list was easy to miss), and Settings > HTTPS states explicitly when no certificate is bound instead of showing nothing (#303, reported by @gb-123-git)

[2.218] - 2026-08-31

Added

• Local ACME accounts: the contact e-mail can now be edited from the account detail (the piece of #303 that had been accepted but not shipped in 2.217). Per RFC 8555 the contact belongs to the ACME client and its next account update may overwrite the value; the edit form says so (#303, reported by @gb-123-git)
• Settings > HTTPS now shows which certificate is bound to the web UI (renewals applied automatically) with a button to stop following renewals; the Let's Encrypt orders list gains the same status filter and naming as the Local orders view (#303, reported by @gb-123-git)
• One-click TSA signing certificate: Settings > TSA > Signing certificate now has a "Generate a signing certificate" action that issues an end-entity certificate purpose-built as an RFC 3161 timestamp signer: BasicConstraints CA:FALSE, KeyUsage digitalSignature only (critical), and a critical, exclusive timeStamping EKU. The generic issue path cannot produce this (it always emits the EKU non-critical and merges the base profile with extra_ekus), so before this an operator had to hand-craft the certificate outside UCM. The private key is stored encrypted at rest. The certificate is issued and committed first; when no usable dedicated signer is configured yet it is then selected as tsa_signer_cert_refid (a second write), and if that selection write fails the certificate stays issued but unselected with a log line. An already-healthy signer is never swapped without an explicit request. Issued through POST /api/v2/tsa/signer-certificate (needs both write:settings and write:certificates), defaulting to the configured TSA CA, RSA 3072, and a 397-day validity clamped to the issuing CA's own expiry. The certificate is an ordinary UCM certificate: in-place renewal keeps the critical exclusive EKU and expiry alerts apply, but the auto-renewal scheduler only covers it if manual is added to auto_renewal_sources (default scep, acme, est); the generate form says so. The TSA page also now shows whether the active signer's timeStamping EKU is critical/exclusive (eku_critical_exclusive), on both the candidate list and the status box (#312, contributed by @Hemsby)
• Dashboard surfacing for a near-expiry TSA signer: the System Health widget now has a TSA badge (disabled / signing with the CA certificate / dedicated signer, turning amber within 30 days of the signer's expiry and grey when the signer is expired, revoked or undecryptable and /tsa is therefore returning 503), and the Next Expirations widget tags the configured dedicated signer with a "TSA signer" chip so its expiry reads as an infrastructure event rather than one certificate among many. Service badges now render a distinct warning state and show their status message on hover. A dedicated signer is an ordinary certificate, so the existing email expiry alerts already cover it; this adds the at-a-glance view (#312, contributed by @Hemsby)

Fixed

• ACME account detail: challenge status badges show valid in green and pending in yellow again (the API capitalizes statuses, the badge mapping compared lowercase, so everything rendered red); the scheduled purge and the purge button now also remove the leftover pending sibling challenges of authorizations validated before 2.217 (#303, reported by @gb-123-git)
• Dashboard: the Webhooks badge queried a column that does not exist, so it always showed "Not configured" no matter how many endpoints were configured; on PostgreSQL the failed query also aborted the transaction, dragging the badges probed after it (TSA included) into their fallback state. The query is fixed and every status probe now resets the session on failure so one broken probe cannot poison the next

Full history: CHANGELOG.md