NeySlim/ultimate-ca-manager v2.246-rc1

on GitHub

[2.245] - 2026-10-23

Security

• The forced password change now holds on the server: until the first-boot admin, or any account asked for a new password, sets one, its session gets 403 for everything but the change, logout and a 2FA enrolment that is itself required, API and WebSocket included. Before, only the web UI asked, so the documented default password gave full API access to a fresh install (reported privately by @EQSTLab).
• Certificate Transparency submission now goes through the pinned SSRF guard: a log URL could be redirected, or its name rebound, to loopback or a cloud metadata address after it was checked (reported privately by @fredlubrano). A log URL aimed at loopback or a cloud metadata address is now also refused when saved.
• ACME HTTP-01 and TLS-ALPN-01 validation now pins its connection under the default policy too, where private addresses are allowed: a name could answer one address to the metadata check and the cloud metadata service to the fetch (reported privately by @heidrickla).
• The PowerDNS and Plesk DNS providers now reach their server through the pinned SSRF guard: their API key, sent in a header of its own, followed a redirect to another host. A server on the same host stays reachable.
• SSH: a CA with no allowed principals signed for any name, root included. It now signs nothing unless Allow any principal is ticked (reported privately by @heidrickla).
• Pillow 13.0.0 is now the minimum: 12.x carries 39 published advisories, mostly in image decoders.
• GitHub Actions are pinned to commit SHAs, kept up to date by Dependabot, and a test refuses an unpinned one.

Changed

• The forced password prompt no longer offers Skip for now or a close button: it offers a logout, and the pages load only once the password is changed, so they no longer fill the screen with refused requests behind it.
• A first-boot admin password set through INITIAL_ADMIN_PASSWORD (Docker UCM_INITIAL_ADMIN_PASSWORD, Helm initialAdminPassword) no longer has to be changed at first login: only the public default changeme123 does, so automated deployments keep API access.
• The packages and the Docker image no longer install pytest, black and flake8: development tools moved to backend/requirements-dev.txt.

Fixed

• ACME proxy: with External Account Binding on, an onlyReturnExisting lookup was refused with externalAccountRequired, so cert-manager got no account URL and its orders failed; the lookup is now answered before the EAB check and never creates an account (#409, by @WMP).
• ACME proxy: the account URL it returns now answers reads, contact updates and deactivation, along with its orders list, and new-account refuses an unknown or disabled endpoint path instead of handing out an account URL under it (#410, #411, reported by @WMP).
• ACME server and proxy: new-account refuses a payload that is not an object, a non-boolean termsOfServiceAgreed or onlyReturnExisting, and a malformed contact with malformed or invalidContact instead of a 500 or a stored value; a deactivated or revoked account gets unauthorized instead of its URL (#412, #413, reported by @WMP).
• ACME server and proxy: every request signed by a deactivated or revoked account now gets unauthorized (401) instead of malformed, and the proxy removes the new account when another registration consumed its EAB credential first, as the server already did.
• ACME proxy: a stale nonce or an unusable account key now gets badNonce or badPublicKey instead of malformed, so clients retry a stale nonce; on both servers a kid that names no account gets accountDoesNotExist.

Upgrade notes

• SSH: existing CAs without allowed principals get Allow any principal ticked, so they keep signing; untick it once their principals are listed. A CA created through the API without a list now signs nothing unless allow_any_principal is true.

[2.244] - 2026-10-23

Added

• SSO: a role mapping entry can grant a custom role, alone or next to a base role, for LDAP, OAuth2 and SAML providers; with "Sync role on every login" the custom role follows the groups, and is removed only when the mapping gave it (#408).
• CAs: an RSA CA can sign with RSA-PSS (salt as long as the hash) instead of PKCS#1 v1.5, chosen at creation or switched later from its details; certificates, CRLs, OCSP responses and SCEP replies follow it, on a local key or a PKCS#11 or OpenBao HSM key; timestamp tokens stay PKCS#1 v1.5 so that openssl ts -verify still checks them.
• Compliance profiles: a CA can follow a profile aligned with ANSSI (PG-083 3.00), BSI (TR-02102-1) or the EU agreed cryptographic mechanisms (ECCG ACM 2.0), which refuses what the text requires and advises against what it only recommends (keys, digests, RSA scheme, key horizons, HSM-held CA key, timestamping signer). A preflight in Settings, the API and the command line lists what a profile would refuse before it is attached to a CA, and an instance default applies to new CAs.
• Keys: Brainpool P256r1, P384r1 and P512r1 (EC-BP256, EC-BP384, EC-BP512) can be used for CA and certificate keys outside FIPS mode, across issuance, enrollment protocols, CRL, OCSP, timestamping and PKCS#11 HSMs, with SHA-384 and SHA-512 by default for the larger curves; the key type lists group them with a TLS compatibility warning, and the compliance profiles accept them. A Brainpool template is not offered to Windows autoenrollment (XCEP).
• Certificates: a certificate using SM2, GOST or FRP256v1 can be imported and is shown by its algorithm name or OID, its chain marked as not verifiable, where it used to raise an error.
• Templates: a template can add the qcStatements extension of ETSI EN 319 412-5 (QcCompliance or QcCClegislation, QcType, QcSSCD, QcPDS, retention period, limit value, semantics identifier) and certificate policy OIDs such as QCP-n, carried by certificates issued from the UI, Sign CSR, ACME, SCEP and approvals and kept on renewal. Certificate details decode the extension and the linter gains an ETSI profile.
• HSM: a provider records the certification its operator declares (Common Criteria EAL 4+, EUCC, FIPS 140-3 or 140-2 level 3), and the eu-acm profile refuses a CA key held on an HSM without an accepted one, FIPS 140-3 level 3 being accepted until the end of 2030.

Upgrade notes

• SSO: saving a provider whose role mapping names an unknown role is refused, where the role silently became Viewer; a custom role named by a mapping can no longer be deleted or renamed until the mapping changes.
• SAML: role mappings now take effect, so review Role Mapping on SAML providers before upgrading, especially with "Sync role on every login" on (see Fixed).
• Helm chart: podSecurityContext and securityContext now default to the non-root user 1000 with fsGroup 1000; values that set them keep theirs.
• Signature hashes: SHA-224 is no longer accepted, and an unknown hash name is refused where it used to be signed in SHA-256 without a word; UCM signs with SHA-256, SHA-384 or SHA-512.
• API keys: the password, e-mail, 2FA, passkey, mTLS certificate and session routes of the account now refuse API keys, even * ones, and so do the user administration routes when they target the key's own owner; scripts that used them must sign in with a session (see Security).
• Enrollment: a CSR with a Brainpool key, refused until now, is accepted outside FIPS mode by Sign CSR, ACME, EST, SCEP and WSTEP; restrict it with a policy's allowed key types if needed.
• Policies: a policy whose allowed key types are all unknown to UCM (an old or imported row) used to check nothing; it now refuses issuance until its key types are fixed. The compliance preflight lists such policies.

Changed

• Dependencies: the minimum versions of Pillow (12.3), lxml (6.1), azure-identity (1.25) and SQLAlchemy (2.0.45) are raised past their known vulnerabilities; fresh installs already picked newer releases.
• CAs: the Create CA dialog defaults to RSA-3072 and warns when an RSA-2048 CA would outlive 2030; the default signature hash of a CA follows the curve size for Brainpool keys as it does for NIST curves.

Security

• Release workflows: dispatch inputs and the triggering tag reach the shell through environment variables and are validated, instead of being interpolated into the script.
• Helm chart: pods run as the image's non-root user (UID 1000) with seccomp RuntimeDefault, no privilege escalation and every capability dropped, where the chart left the security context empty.
• Accounts: an API key, whatever its scopes, can no longer change its owner's password or e-mail, enable or reset 2FA, link an SSO identity, register a passkey or enrol an mTLS certificate, through the account or the user administration routes, which let a key take over the account it belongs to; enabling 2FA no longer replaces a confirmed secret.
• API keys: a key can no longer create or regenerate a key with scopes it does not hold itself; a narrow key belonging to an administrator could mint a * key.

Fixed

• SSO: the Attribute Mapping of OAuth2 and SAML providers was read backwards, so a row such as user.userprincipalname → username was ignored; it is now read as the form shows it, and mappings saved the other way round, such as username → email, keep working (#408).
• SAML: logins now apply the provider's role mapping, which never received the assertion's groups, so every SAML user got the default role; groups are read from groups and the Entra ID / AD FS group and role claims, or from the attributes mapped to groups (#408, thanks @clinde04).
• EST: /csrattrs no longer asks for a challengePassword, which UCM never checked; the FortiOS EST client took it as a request for proof-of-possession and hung on /simpleenroll.
• EST: re-enrolment over native mTLS failed for every client with "Invalid client certificate": the TLS worker hands the client certificate over as DER and /simplereenroll read it as PEM; it is now converted, and /serverkeygen with a client certificate is fixed the same way.
• EST: responses carried their base64 on one unbroken line, which RFC 2045 (the transfer encoding RFC 7030 uses) limits to 76 characters; clients decoding with OpenSSL's base64 BIO, the FortiOS EST client among them, failed on /cacerts with "Failed to decode base64 msg". Responses are now wrapped at 64 characters.
• Reports: the Expiry Report tile showed Disabled whatever the Expiring Certificates schedule; it now follows that schedule.
• Certificates: an RSA-PSS signature is shown with its hash and salt length ("RSASSA-PSS SHA-256 (salt 32)") and scored by its hash, and a Brainpool key is scored like the NIST curve of the same size, where both counted as unrated.
• Signing: an unknown signature hash is refused instead of being replaced by SHA-256, and an EdDSA certificate is no longer offered or accepted as the TSA signer, which failed every timestamp request.
• Imports and SCEP: chains signed in RSA-PSS are rebuilt by the smart import, which checked them as PKCS#1 v1.5, and SCEP accepts RSA-PSS signed requests.
• HSM: a signature the provider cannot produce (RSA-PSS, a digest other than SHA-256/384/512) is refused instead of yielding a certificate or CRL whose signature does not verify.
• CAs: a cross-certificate of a self-signed root no longer replaces the root's own certificate, through an import or a certificate installed after a renewal CSR: it is refused until cross-certificates can be attached; the hourly chain repair no longer deletes a self-signed root stored next to its cross-certificate, and merges only records holding the same certificate (#400).
• Docker and RPM: COMMERCIAL-LICENSE.md, which NOTICE refers to, now ships in the image and is installed with the RPM licence files, so a system installed without documentation keeps it.

Full history: CHANGELOG.md