NeySlim/ultimate-ca-manager v2.254.3-rc1 on GitHub

📜 Recent release history (last 2 versions)

[2.254.2] - 2026-11-15

Changed

Updates: the update check, the update notification and the unattended install now stay within the installed major version, so a later major version is never installed automatically and this line's maintenance releases stay visible (releases are now read 100 per page).
Updates: a later major version published as a final release is offered apart as a recommended upgrade with its release notes, installed only on an explicit, confirmed request (major_upgrade: true and its version on POST /api/v2/system/updates/install); system.update_available announces it once per major version, with major_upgrade set.
Updates: the Updates page states that this version line is in security maintenance: security fixes will keep coming, new features will not.

[2.254.1] - 2026-11-14

Security

Account: disabling 2FA or regenerating recovery codes now counts its TOTP or recovery code against the login's second-factor lockout, so a stolen session can no longer guess the code without limit; past max_login_attempts both answer 429 and the account's next login waits for the lock to expire. POST /api/v2/account/2fa/confirm answers 409 once TOTP is enabled, instead of checking a code and issuing new recovery codes.
Dependencies: dnspython 2.9.2, which bounds the services of a WKS record (CVE-2026-128089). UCM parses record text only for TXT values it computes, so no UCM path was exposed.

Full history: CHANGELOG.md

Installation

Docker (Recommended)

# From Docker Hub
docker pull neyslim/ultimate-ca-manager:2.254.3-rc1

# Or from GitHub Container Registry
docker pull ghcr.io/neyslim/ultimate-ca-manager:2.254.3-rc1

# Run
docker run -d -p 8443:8443 \
  -e SECRET_KEY=$(openssl rand -hex 32) \
  --name ucm neyslim/ultimate-ca-manager:2.254.3-rc1

Debian/Ubuntu

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.254.3-rc1/ucm_2.254.3.rc1_all.deb
sudo dpkg -i ucm_2.254.3.rc1_all.deb
sudo apt-get install -f

Fedora

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.254.3-rc1/ucm-2.254.3.rc1-1.fc43.noarch.rpm
sudo dnf install ./ucm-2.254.3.rc1-1.fc43.noarch.rpm

RHEL, AlmaLinux, Rocky Linux 9

wget https://github.com/NeySlim/ultimate-ca-manager/releases/download/v2.254.3-rc1/ucm-el9-2.254.3.rc1-1.el9.noarch.rpm
sudo dnf install ./ucm-el9-2.254.3.rc1-1.el9.noarch.rpm

FIPS mode (preview)

FIPS mode is a preview: feedback is welcome on #399. Full guide: FIPS Mode.

Docker, any Linux host (amd64, arm64):

docker run -d -p 8443:8443 -e UCM_FIPS=1 \
  -v ucm-data:/opt/ucm/data -v ucm-config:/etc/ucm \
  --name ucm neyslim/ultimate-ca-manager:2.254.3-rc1-fips

Ubuntu 24.04 with Ubuntu Pro (sudo pro enable fips-updates, then reboot):

sudo apt-get install -y gcc pkg-config python3-dev python3-venv libpq-dev libxml2-dev libxslt1-dev \
    zlib1g-dev libssl-dev libxmlsec1-dev libxmlsec1t64-openssl rustc-1.91 cargo-1.91
sudo install -d -m 750 /etc/ucm && echo 'UCM_FIPS_BUILD=1' | sudo tee /etc/ucm/ucm.env
sudo apt install ./ucm_2.254.3.rc1_all.deb

RHEL, AlmaLinux, Rocky Linux 9 (sudo fips-mode-setup --enable, then reboot; on RHEL, enable CodeReady Builder instead of CRB):

sudo dnf config-manager --set-enabled crb
sudo dnf install -y python3.12-devel gcc pkgconf-pkg-config libpq-devel libxml2-devel libxslt-devel \
    openssl-devel xmlsec1-devel xmlsec1-openssl libtool-ltdl-devel rust cargo
sudo install -d -m 750 /etc/ucm && echo 'UCM_FIPS_BUILD=1' | sudo tee /etc/ucm/ucm.env
sudo dnf install ./ucm-el9-2.254.3.rc1-1.el9.noarch.rpm

The package builds its crypto libraries against the system OpenSSL (about five minutes), sets UCM_FIPS=1 on a host in FIPS mode and prints a readiness report. Fedora, Debian and other distributions are not supported in FIPS mode: use the Docker image.

Silent/Automated Install

# Skip firewall prompts for CI/automation
sudo UCM_PORT=8443 UCM_FIREWALL=no dpkg -i ucm_2.254.3.rc1_all.deb

Default Credentials

Username: admin
Password: changeme123

Change the password immediately after first login!

Documentation

Installation Guide
API Documentation