NeySlim/ultimate-ca-manager v2.222-rc1

on GitHub

[2.221] - 2026-09-05

Added

• ACME certificate profiles can bind a certificate template. An ACME order carries no template, so the built-in server could only ever issue the server certificate defaults; a profile (draft-ietf-acme-profiles) now has a Template field, and the bound template's key usage and extended key usage govern every certificate issued under that profile, on top of the key-algorithm rule. Validity and digest stay those of the profile. The issued certificate keeps the template link and records its divergences from the template defaults, as certificates from the issue form do. CA templates and templates carrying OCSP signing, timestamping, any-purpose or smartcard logon EKUs are refused at save time with a 400, and a template bound to a profile cannot be deleted until the profile is unbound, so a reused template id can never put a foreign template's key usage on ACME certificates; a template edited into an all-refused EKU set yields the server certificate default, never the CSR's own request. Backups carry a profile's template binding by template name and re-resolve it against the restored templates, since template ids are not portable between instances. PATCH /api/v2/acme/settings accepts template_id per profile and GET returns it (#327)

Fixed

• Dashboard: the SCEP service tile now reflects the SCEP configuration instead of always reporting the endpoint as available. It reads Disabled when SCEP is turned off, Enabled with no CA assigned or Enabled with CA not usable when neither the global CA nor an enabled SCEP profile can serve an enrollment (a CA the endpoint refuses, offline, without key or certificate, or HSM-backed, does not count), and Configured (with the usable profile count) otherwise (#328, reported by @JoseGoncalves)
• Dashboard: the SMTP service tile read configuration keys the Email settings page never writes, so a configured and working SMTP setup was reported as Not configured. It now reads the stored SMTP configuration with the sender's own readiness rule: Not configured without a host, Configured but disabled when the host is set but email is off, a warning when the port or From address is missing, and the host name when ready. The forgot-password endpoint used the same stale key and refused every reset request with "email not configured"; it now checks the same configuration (#329, reported by @JoseGoncalves)
• Certificate key usage now follows the key algorithm on every issuance path. An ECDSA leaf carried keyEncipherment, which is RSA key transport and cannot be performed with an EC key (RFC 5480 §3), unless it was issued from a template with the bit deselected; an ACME order has no template to select, so an ACME client got the bit regardless of key algorithm, and certificate linters flagged the result. A non-RSA key now never receives keyEncipherment or dataEncipherment, whether the built-in profile, the template or the CSR asked for them: a TLS server or client certificate on an EC key gets digitalSignature only, on the issue form, the approval workflow, Sign CSR, ACME, EST, SCEP and WSTEP alike, and an S/MIME certificate on an EC key keeps its encryption intent as keyAgreement, the bit ECDH-based S/MIME clients require on an EC recipient certificate. RSA certificates are unchanged (#327, reported by @JoseGoncalves)

[2.220] - 2026-09-04

Added

• Name constraints can now be set when creating a CA. The Create CA wizard's Advanced Constraints section gained permitted and excluded subtree fields (DNS, IP range, email), and POST /api/v2/cas accepts nameConstraintsPermitted / nameConstraintsExcluded as {type, value} lists and emits them as the critical NameConstraints extension. The request validation previously required plain strings while the extension builder expected objects, so no payload actually produced a constrained CA; malformed entries are now rejected with 400 at the API boundary instead of being silently dropped or producing an unusable CA: unknown type, IP network with host bits set, empty value, a DNS value that is not a plain domain (URL, path, wildcard, underscore, or an RFC-5280-invalid leading dot), an e-mail value that is not a mailbox, host or .domain form with a valid local part, and non-ASCII values. rfc822Name constraints are also now enforced against the subject DN emailAddress attribute, not only SAN e-mail addresses, on every issuance path, and the three e-mail constraint forms are matched per RFC 5280 (example.com = that host only, .example.com = its subdomains only, user@example.com = that mailbox) so a constrained CA no longer issues certificates that fail OpenSSL chain validation. Constraints entered for an external-CSR CA are refused, since the signing CA applies them there. They still cannot be changed after creation, as the extension is part of the signed certificate (#316, reported by @JoseGoncalves, contributed by @Hemsby)
• The certificate template editor's Key Type dropdown now offers RSA-3072 and EC-P521. Both were already accepted by the template API and produced working certificates at issuance; only the dropdown was missing them (#318 follow-up)

Fixed

• ACME proxy: a domain the upstream CA has already validated (a pre-validated or onboarded domain, typically on an EAB-bound account) no longer fails with "Upstream CA does not offer dns-01 challenge". An authorization the upstream reports as valid is now passed through untouched, so the client goes straight to finalize; a pending authorization without a dns-01 challenge is still refused, since the proxy can only automate dns-01 (#325, reported by @spijker)
• Certificate expiry alerts: every selected alert day is now stored and used. Saving 14, 7, 3 and 1 kept only 14 because the configuration row had a single threshold column, and the daily job then sent a reminder every day once a certificate entered that single window. Each selected threshold now fires once per validity period (and again after a renewal), the Include revoked certificates toggle is persisted and honoured, invalid selections are rejected with 400, and the in-memory alert settings module the scheduler never read has been removed. Upgrade note: existing installs keep their current single threshold until a new selection is saved, and alerts that used to repeat daily inside the window now go out once per threshold (#323, #324, reported by @JoseGoncalves)
• Email settings: choosing the None authentication method no longer shows Password after a reload. The API reported the stored default method even when SMTP authentication was off and dropped none on save; it now reports none whenever authentication is disabled, accepts it, and the form derives the highlighted method from that field (#322, reported by @JoseGoncalves)
• Certificate issue form: picking an EC certificate template (or switching Key Type from RSA to ECDSA) filled Key Type but left Key Size blank, so issuance failed with "EC curve must be P-256, P-384, or P-521". The Key Size dropdown swaps its options when the key type changes, and the shared Select wrapper was forwarding the reset event the list swap triggers as a real selection, wiping the value; it now ignores a change to a value that is not one of its current options. The same latent problem in the Create CA wizard's key size field is fixed by the same change. The issue API also fills the key size from the template when the request sends a key type but no size, on both the direct and the approval-workflow issuance paths, so an approved request for an EC template no longer drops to a P-256 key; a non-string key type in the payload now returns 400 instead of 500 (#318, reported by @JoseGoncalves, contributed by @Hemsby)

Security

• Private-key encryption now stops creating plaintext key mirrors and removes existing mirrors when enabled and at startup; Settings reports the on-disk count, disabling encryption recreates the mirrors, and Deployment adds a same-host SFTP preset for services that need key files. Upgrade note: on the first start with key encryption enabled, plaintext key files under the private directory are removed; anything that read them directly must move to deploy hooks (same-host SFTP target) or the API export. Certificate files are untouched (#320, reported by @kzshantonu)

Full history: CHANGELOG.md