NeySlim/ultimate-ca-manager v2.239-rc1

on GitHub

[2.238] - 2026-10-12

Added

• Trust store: certificates can be selected and removed together, for instance the system CAs filtered as expired; only the rows the current filters show are removed (#388, reported by @lengqing5977).
• Email expiry alerts can skip the certificates issued by the ACME server, since their clients renew them; off by default (#386, reported by @lengqing5977).
• Sign CSR: names (email, DNS, IP, URI) can be added to those of the request, for instance the email address of an S/MIME certificate requested from a smart card. A signed request can also be put back in the pending list to be signed again, since such a device cannot always produce it twice (#389, reported by @lengqing5977).

Changed

• Auto-renewal: "Run now" also reports the expiring certificates it left alone and why (not yet in the last third of their lifetime, private key not held by the server, source not selected), and the renewal window field states the last-third rule (#387, reported by @lengqing5977).

Fixed

• Dashboard: on Windows at 150% display scaling, a scrollbar could appear and disappear in a loop, making the page flicker (#390, reported and fixed by @lengqing5977).
• Audit log retention: the daily purge failed whenever it had something to delete, and the Settings › Audit field was disabled and its value ignored. The retention is now stored and nothing is purged until an administrator sets one; archive_before_delete, which was never implemented, is refused by the API.
• CSRs › History: "Download certificate" downloaded the signing request instead of the certificate. It now downloads the certificate, and the request has its own button (#389, reported by @lengqing5977).
• Settings › Email: saving cleared the test recipient, which defaulted to the sender address. It now stays filled in and defaults to the signed-in user's email (#386, reported by @lengqing5977).
• Docker: a bind-mounted data directory the container cannot write to stopped startup with "check volume permissions". The message now names its owner and the fix (chown -R 1000:1000), and the installation guide documents it (#386).

[2.237] - 2026-10-09

Fixed

• Remote syslog could not be switched to TCP in Settings › Audit, nor its framing changed, so TLS and octet framing were out of reach too: both selectors threw on every choice and now save it (#380, reported by @arthur-2sheds-jackson, by @heidrickla).
• The login page lost its SSO buttons until a full reload when the provider list failed to load, typically after a session expired while the network was briefly down (a laptop waking from sleep). It now retries the list, reselects the LDAP provider last used, and a failed sign-in method check no longer hides providers that loaded (#384, reported and fixed by @mripkens-reuter).
• A tab whose inactivity timeout ran out while the server was unreachable signed the user out locally without reaching the server; it now asks again every 30 seconds, "Stay logged in" no longer signs out either, and the tab locks locally only after 5 minutes without an answer (#384).

Full history: CHANGELOG.md