github NeySlim/ultimate-ca-manager v2.254.2
v2.254.2 The Last Stand
on GitHub

57 minutes ago

2.254 is the last stand of UCM 2.x: security fixes will keep coming, new features will not. The next chapter is already being written.

What's Changed

Changed

  • Updates: the update check, the update notification and the unattended install now stay within the installed major version, so a later major version is never installed automatically and this line's maintenance releases stay visible (releases are now read 100 per page).
  • Updates: a later major version published as a final release is offered apart as a recommended upgrade with its release notes, installed only on an explicit, confirmed request (major_upgrade: true and its version on POST /api/v2/system/updates/install); system.update_available announces it once per major version, with major_upgrade set.
  • Updates: the Updates page states that this version line is in security maintenance: security fixes will keep coming, new features will not.
📜 Recent release history (last 2 versions)

[2.254.1] - 2026-11-14

Security

  • Account: disabling 2FA or regenerating recovery codes now counts its TOTP or recovery code against the login's second-factor lockout, so a stolen session can no longer guess the code without limit; past max_login_attempts both answer 429 and the account's next login waits for the lock to expire. POST /api/v2/account/2fa/confirm answers 409 once TOTP is enabled, instead of checking a code and issuing new recovery codes.
  • Dependencies: dnspython 2.9.2, which bounds the services of a WKS record (CVE-2026-128089). UCM parses record text only for TXT values it computes, so no UCM path was exposed.

[2.254] - 2026-11-13

Fixed

  • CA import: an imported CA is linked at once to the stored CA whose key signed it (CA import, certificate import, OPNsense and smart import, whatever the order of a batch), so SCEP GetCACert in chain mode serves the chain without waiting for the hourly repair. Smart import prefers that CA over a same-name one, and still links by name when no stored CA verifies the signature.
  • Kerberos: a Kerberos Microsoft CA connection pointed KRB5_KTNAME at its own keytab for the whole process, so XCEP and WSTEP could then accept with the wrong keys; it now sets its client keytab only.
  • ACME: revoke-cert with reason 8 (removeFromCRL, a delta CRL entry only) is refused with badRevocationReason, on the server and the proxy, which also answered malformed for any invalid reason.
  • Backup: a revocation record archived under a hexadecimal spelling of its serial (0x, colons) is restored in a spelling the CRL reads, and two spellings of one serial in an archive both stay, the gravest reason answering.
  • WSTEP, EST and SCEP: a renewed certificate keeps the SID security extension (KB5014754 strong mapping) of the certificate it renews when the CA signed that certificate, never one from the CSR, so it still maps to its account on a domain controller enforcing strong mapping; with the AD Connector enabled, a SID that names no account is refused.
  • Packages: the DEB installation no longer fails on a host without sudo; the unused sudoers file is no longer written and is removed from both the DEB and the RPM.

Security

  • Backup: a merge restore no longer turns a certificate or a CA revoked for good here back into a hold or a valid one, nor its revocation record into a hold.
  • Certificates: an imported certificate is now linked to a CA only when that CA's signature on it verifies, and renewal, re-enrolment and status checks only treat as issued by a CA a stored certificate it signed.
  • OCSP: a serial the CA revoked answers revoked, as on its CRL, even when a non-revoked record of that serial is stored again.
  • Certificates: a certificate imported again after its revocation and deletion comes back revoked, and a certificate its CA's revocation record names is no longer renewed in place.
  • Revocation: a certificate its CA recorded as revoked is now shown and treated as revoked everywhere, and an hourly pass marks such certificates revoked, with an audit entry.
  • Revocation: when a final revocation is recorded, on the certificate or on its CA's record, lifting a hold is refused with one code (409) and one message; otherwise it removes the hold's record in each unambiguous spelling of its serial and under every record of the CA key.
  • Revocation: revoking or suspending a certificate its CA already recorded as revoked for good answers that it is already revoked; a recorded hold can still be made final.
  • Revocation: the upgrade deletes once the suspension records that lifting a hold used to leave behind.
  • Revocation: a hold its CA recorded but the certificate does not show yet can be lifted, and the certificate details and list show the revocation the CA recorded.
  • Backup: restored certificates take the revocation their CA recorded at once, with an audit entry, and an archive from a release before 2.254 no longer brings back as holds the records a lifted hold left behind (the restore result counts them).
  • mTLS: an administrator importing a certificate for a user can no longer enrol a revoked certificate.
  • Renewal: a certificate whose signature no longer verifies with its CA's current key (CA re-keyed or replaced under the same name) is refused with a message asking for a new certificate.

Full history: CHANGELOG.md

Installation

Docker (Recommended)

# From Docker Hub
docker pull neyslim/ultimate-ca-manager:2.254.2

# Or from GitHub Container Registry
docker pull ghcr.io/neyslim/ultimate-ca-manager:2.254.2

# Run
docker run -d -p 8443:8443 \
  -e SECRET_KEY=$(openssl rand -hex 32) \
  --name ucm neyslim/ultimate-ca-manager:2.254.2

Debian/Ubuntu

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.254.2/ucm_2.254.2_all.deb
sudo dpkg -i ucm_2.254.2_all.deb
sudo apt-get install -f

Fedora

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.254.2/ucm-2.254.2-1.fc43.noarch.rpm
sudo dnf install ./ucm-2.254.2-1.fc43.noarch.rpm

RHEL, AlmaLinux, Rocky Linux 9

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.254.2/ucm-el9-2.254.2-1.el9.noarch.rpm
sudo dnf install ./ucm-el9-2.254.2-1.el9.noarch.rpm

FIPS mode (preview)

FIPS mode is a preview: feedback is welcome on #399. Full guide: FIPS Mode.

Docker, any Linux host (amd64, arm64): 

docker run -d -p 8443:8443 -e UCM_FIPS=1 \
  -v ucm-data:/opt/ucm/data -v ucm-config:/etc/ucm \
  --name ucm neyslim/ultimate-ca-manager:2.254.2-fips

Ubuntu 24.04 with Ubuntu Pro (sudo pro enable fips-updates, then reboot): 

sudo apt-get install -y gcc pkg-config python3-dev python3-venv libpq-dev libxml2-dev libxslt1-dev \
    zlib1g-dev libssl-dev libxmlsec1-dev libxmlsec1t64-openssl rustc-1.91 cargo-1.91
sudo install -d -m 750 /etc/ucm && echo 'UCM_FIPS_BUILD=1' | sudo tee /etc/ucm/ucm.env
sudo apt install ./ucm_2.254.2_all.deb

RHEL, AlmaLinux, Rocky Linux 9 (sudo fips-mode-setup --enable, then reboot; on RHEL, enable CodeReady Builder instead of CRB): 

sudo dnf config-manager --set-enabled crb
sudo dnf install -y python3.12-devel gcc pkgconf-pkg-config libpq-devel libxml2-devel libxslt-devel \
    openssl-devel xmlsec1-devel xmlsec1-openssl libtool-ltdl-devel rust cargo
sudo install -d -m 750 /etc/ucm && echo 'UCM_FIPS_BUILD=1' | sudo tee /etc/ucm/ucm.env
sudo dnf install ./ucm-el9-2.254.2-1.el9.noarch.rpm

The package builds its crypto libraries against the system OpenSSL (about five minutes), sets UCM_FIPS=1 on a host in FIPS mode and prints a readiness report. Fedora, Debian and other distributions are not supported in FIPS mode: use the Docker image.

Silent/Automated Install

# Skip firewall prompts for CI/automation
sudo UCM_PORT=8443 UCM_FIREWALL=no dpkg -i ucm_2.254.2_all.deb

Default Credentials

  • Username: admin
  • Password: changeme123

Change the password immediately after first login!

Documentation

Check out latest releases or
releases around NeySlim/ultimate-ca-manager v2.254.2

Don't miss a new ultimate-ca-manager release

NewReleases is sending notifications on new releases.

Get notifications