NeySlim/ultimate-ca-manager v2.243-rc2

on GitHub

[2.242] - 2026-10-18

Added

• Administrators see a small dismissible card suggesting support on Ko-fi, once per UCM version after an install or update, and Settings > About links to it.

Fixed

• A preference change (language, theme, a dismissed window) made before the user's saved preferences had loaded (just after signing in, or after a failed load) replaced them all on the server; it is now saved together with them once they load.
• DEB and RPM: an upgrade rebuilt the Python environment while UCM was still running on it, which logged errors such as a missing CA bundle for the update check (up to five minutes with UCM_FIPS_BUILD=1). The service is now stopped during the rebuild and started again on the previous environment when the build fails or is interrupted, and the update screen waits up to ten minutes for it.
• DEB: the install banner listed softhsm2 as missing when apt installed it in the same run.
• FIPS mode (Docker): the module was installed without -pedantic, which left the Extended Master Secret check and the DRBG digest restriction of its approved mode off. Both are now on and UCM refuses to start when a required setting is off (the service status lists them); TLS 1.2 peers without Extended Master Secret are refused.
• FIPS mode (Docker): the HTTPS server and UCM's TLS clients negotiated X25519, which the module's security policy does not allow. TLS now uses only the NIST curves and FFDHE groups, and UCM refuses to start in FIPS mode when TLS still accepts X25519 or X448.
• FIPS mode: SSH deployments checked Ed25519 host keys with libsodium and could fall back to a Diffie-Hellman key exchange computed outside the module. They now negotiate only ECDSA or RSA host keys, ECDH on NIST curves, AES and HMAC-SHA-1/SHA-2, and a target pinned to an Ed25519 host key asks for a pin reset.
• FIPS mode: with a Kerberos ticket present, libpq could encrypt the PostgreSQL connection with GSSAPI, which runs in the Kerberos library outside the module, instead of TLS. UCM now turns GSSAPI encryption off for itself and its backup tools, and refuses to start when gssencmode or PGGSSENCMODE asks for it.
• The PostgreSQL snapshot taken before a database migration ran pg_dump without the service's libpq settings (PGSSLMODE, PGSSLROOTCERT, PGGSSENCMODE…) when the URL did not repeat them. It now keeps them, as the live connection does, and FIPS mode turns GSSAPI encryption off for it.
• FIPS readiness report: it advised switching NTLM WinRM channels to Kerberos, which the Docker image cannot run; it now advises turning the channel off unless Kerberos is installed. It also reports deploy targets pinned to an Ed25519 host key, PostgreSQL set to GSSAPI encryption and private keys stored without a master key.

[2.241] - 2026-10-18

Added

• FIPS mode (preview): with UCM_FIPS=1, UCM refuses to start unless its crypto libraries run on an active OpenSSL FIPS provider and pass their self-tests and PostgreSQL is reached over TLS, generates keys through the provider, and refuses what it does not approve (Ed25519 and Ed448, MD5, 3DES, scrypt and Argon2id, legacy PKCS#12 and JKS exports, PKCS#12 import, SCEP key transport in PKCS#1 v1.5, NTLM to a Microsoft CA). UCM is not FIPS validated itself. This is a first release of FIPS mode: feedback is welcome on #399 (requested by @Stryker-88).
• Docker: building with UCM_FIPS_BUILD=1 adds the OpenSSL 3.1.2 FIPS provider (CMVP certificate #4985) and links cryptography, psycopg2 and xmlsec to the system OpenSSL; the image runs in standard mode without UCM_FIPS, and the Helm chart has fips.enabled (#399).
• Service status shows the OpenSSL library and FIPS provider in use, and /api/v2/health reports fips_active (#399).
• Backups: "kdf": "pbkdf2" at creation writes an archive that a FIPS-mode instance can restore (#399).
• DEB and RPM: with UCM_FIPS_BUILD=1 in /etc/ucm/ucm.env before the install, RHEL 9 and Ubuntu 24.04 hosts build cryptography, psycopg2, lxml and xmlsec against the system OpenSSL, and a host in FIPS mode gets UCM_FIPS=1 and the readiness report (#399). Upgrades rebuild a package only when its version changed (pip's wheel cache otherwise), and the updater refuses the update when a build tool is missing.
• RPM for RHEL, AlmaLinux and Rocky Linux 9 (ucm-el9-2.243-rc2-1.el9.noarch.rpm), running on python3.12; the Fedora RPM is unchanged and the updater picks the build matching the host.
• FIPS readiness check: python -m scripts.fips_preflight, GET /api/v2/system/fips-preflight and a button under Settings > About list, on a standard instance, what FIPS mode would refuse (scrypt passwords, Ed25519 authorities, hmac-md5 TSIG, Argon2id backups, PostgreSQL without TLS...) with a remedy for each; scheduled backups gain a KDF setting (#399).

Changed

• Upgrade note: SAML responses and assertions signed or digested with SHA-1 are refused; an identity provider still using SHA-1 (an older ADFS relying party trust, for instance) must switch to SHA-256 (#399).
• Upgrade note: WSTEP requests whose WS-Security signature does not use RSA or ECDSA with SHA-256, SHA-384 or SHA-512 are refused (#399).
• python-jose, which nothing used, is no longer installed (#399).

Fixed

• DEB and RPM: an /etc/ucm/ucm.env written before the install was kept as is, without secrets, and the service did not start. Missing secrets and defaults are now added, without changing any value already there.

Full history: CHANGELOG.md