NeySlim/ultimate-ca-manager v2.227-rc1

on GitHub

[2.226] - 2026-09-09

Added

• Intermediate CA revocation: Revoke CA on an intermediate (POST /api/v2/cas/<id>/revoke, write:cas) with the RFC 5280 reasons and optional invalidity date. The serial goes on the parent's persistent revocation list, the parent's CRL is regenerated and its OCSP responder answers revoked. The revoked CA and everything below it can no longer sign (issue form, CSRs, renewals, sub-CAs, ACME, EST, SCEP, WSTEP, TSA, OCSP responders); its own CRL keeps being served. The record belongs to the parent and outlives the CA row, so a deleted and re-imported CA comes back revoked. Roots and CAs with an external issuer are not revocable here. When the parent cannot regenerate its CRL, the response says so. New Revoked status and filter, audit action ca_revoked (#343, reported by @j2r2k2)

Fixed

• An active filter survives an action performed from a certificate's detail window, on the certificates and SSH certificates pages; the Orphan filter works on the first load (#345, reported by @kiar1404-de)
• The OCSP responder answered unknown for the certificate of an intermediate CA: it now recognises the certificates of the CAs signed by the requested issuer and answers good or revoked (#344, reported by @j2r2k2)

[2.225] - 2026-09-09

Added

• A CSR generated in UCM can be completed by a certificate issued elsewhere. The workflow for a public or third-party CA (generate the CSR in UCM, download it, have it signed, import the certificate) ended with a certificate record that had no private key: the import matched existing records on subject and issuer, which a CSR record never has, so the certificate was stored as a separate keyless entry and could not be exported with its key. The import (Certificates page and Smart Import) now recognises a certificate whose public key is that of a pending CSR, completes that CSR record and keeps its private key, so the certificate exports with the key like any other; the match is made on the key pair, so it holds when the CA rewrites the subject. A key that arrives alongside the certificate is attached when the CSR was uploaded without one. The CSR page also gained Download Private Key on a pending CSR that holds its key (GET /api/v2/csrs/<id>/export?format=key, or POST with a password for encrypted PKCS#8), gated like every direct key export by the admin-only read:private_keys permission and recorded in the audit log (#341, reported by @kiar1404-de)

Fixed

• A certificate issued from a CSR generated in UCM no longer appears as "CSR for " in the certificates list. The generator described the request that way and signing kept the description, which the list shows as the certificate's name. A generated CSR is now described by its CN, and signing or completing a CSR created before this release drops the old prefix (#342, reported by @kiar1404-de)

Full history: CHANGELOG.md