NeySlim/ultimate-ca-manager v2.247-rc3

on GitHub

[2.246] - 2026-10-27

Added

• ACME proxy: optional DNS UPDATE (RFC 2136) listener, off by default, so standard rfc2136 solvers can answer DNS-01 through the proxy with per-account TSIG keys (#416).

Fixed

• PostgreSQL: the web worker reused the database connections that the main process opened at startup and kept using for scheduled tasks, so the replies of both could interleave (intermittent PGRES_TUPLES_OK errors, rows of another query, an unhealthy container). Each worker now opens its own.
• The HTTP protocol server (CDP, OCSP, AIA, HTTP-01) stopped after systemctl reload ucm until the next restart, because the new worker could not take the port from the old one; it now waits for the port to be released.
• ACME proxy: a challenge response now carries Link: rel="up" even when the upstream CA omits it (Pebble), which certbot and lego require (#420, reported by @WMP).
• ACME: deactivating an authorization (RFC 8555 §7.5.2), as lego does after a failed validation, got malformed from the native server and the proxy. Both now accept it; the proxy deactivates the upstream authorization only when no other pending order shares it (#422, reported by @WMP).
• ACME: newAccount with an already registered key got externalAccountRequired, or a refusal of its used EAB, when EAB is required. The native server and the proxy now return the existing account, as RFC 8555 §7.3.1 requires (reported by @WMP).
• UI: the danger-soft and warning-soft buttons, the red icon tiles, the outline button hover and a few tinted panels (CA details, login, reports) referred to colour tokens that were never defined and rendered without their colour. A test now fails the suite when the source uses an undeclared token.

Documentation

• New guide docs/integrations/acme-proxy-clients.md: how to use the ACME proxy from hosts without DNS API access, with a no-op DNS-01 step for certbot, acme.sh, lego, cert-manager (stub acme-dns example in examples/kubernetes/cert-manager/), win-acme and Posh-ACME, and the DNS resolver limits of each client (#416).

[2.245] - 2026-10-23

Security

• The forced password change now holds on the server: until the first-boot admin, or any account asked for a new password, sets one, its session gets 403 for everything but the change, logout and a 2FA enrolment that is itself required, API and WebSocket included. Before, only the web UI asked, so the documented default password gave full API access to a fresh install (reported privately by @EQSTLab).
• Certificate Transparency submission now goes through the pinned SSRF guard: a log URL could be redirected, or its name rebound, to loopback or a cloud metadata address after it was checked (reported privately by @fredlubrano). A log URL aimed at loopback or a cloud metadata address is now also refused when saved.
• ACME HTTP-01 and TLS-ALPN-01 validation now pins its connection under the default policy too, where private addresses are allowed: a name could answer one address to the metadata check and the cloud metadata service to the fetch (reported privately by @heidrickla).
• The PowerDNS and Plesk DNS providers now reach their server through the pinned SSRF guard: their API key, sent in a header of its own, followed a redirect to another host. A server on the same host stays reachable.
• SSH: a CA with no allowed principals signed for any name, root included. It now signs nothing unless Allow any principal is ticked (reported privately by @heidrickla).
• Pillow 13.0.0 is now the minimum: 12.x carries 39 published advisories, mostly in image decoders.
• GitHub Actions are pinned to commit SHAs, kept up to date by Dependabot, and a test refuses an unpinned one.

Changed

• The forced password prompt no longer offers Skip for now or a close button: it offers a logout, and the pages load only once the password is changed, so they no longer fill the screen with refused requests behind it.
• A first-boot admin password set through INITIAL_ADMIN_PASSWORD (Docker UCM_INITIAL_ADMIN_PASSWORD, Helm initialAdminPassword) no longer has to be changed at first login: only the public default changeme123 does, so automated deployments keep API access.
• The packages and the Docker image no longer install pytest, black and flake8: development tools moved to backend/requirements-dev.txt.

Fixed

• ACME proxy: with External Account Binding on, an onlyReturnExisting lookup was refused with externalAccountRequired, so cert-manager got no account URL and its orders failed; the lookup is now answered before the EAB check and never creates an account (#409, by @WMP).
• ACME proxy: the account URL it returns now answers reads, contact updates and deactivation, along with its orders list, and new-account refuses an unknown or disabled endpoint path instead of handing out an account URL under it (#410, #411, reported by @WMP).
• ACME server and proxy: new-account refuses a payload that is not an object, a non-boolean termsOfServiceAgreed or onlyReturnExisting, and a malformed contact with malformed or invalidContact instead of a 500 or a stored value; a deactivated or revoked account gets unauthorized instead of its URL (#412, #413, reported by @WMP).
• ACME server and proxy: every request signed by a deactivated or revoked account now gets unauthorized (401) instead of malformed, and the proxy removes the new account when another registration consumed its EAB credential first, as the server already did.
• ACME proxy: a stale nonce or an unusable account key now gets badNonce or badPublicKey instead of malformed, so clients retry a stale nonce; on both servers a kid that names no account gets accountDoesNotExist.

Upgrade notes

• SSH: existing CAs without allowed principals get Allow any principal ticked, so they keep signing; untick it once their principals are listed. A CA created through the API without a list now signs nothing unless allow_any_principal is true.

Full history: CHANGELOG.md