Open Source • BSD-3-Clause

Your PKI,
one install away.

The self-hosted certificate authority with a modern web UI. Create, manage, discover and automate your certificates. No YAML, no CLI expertise needed.

$ docker run -d -p 8443:8443 neyslim/ultimate-ca-manager

Get Started GitHub Support

Latest release v2.235 , 26 September 2026

🔒 pki.example.com

UCM dashboard: certificate overview, issuance activity, system health and expirations

Up and running in 60 seconds

Choose your platform. One command, full PKI.

docker run -d --restart=unless-stopped \
  --name ucm \
  -p 8443:8443 \
  -p 8080:8080 \
  -v ucm-data:/opt/ucm/data \
  neyslim/ultimate-ca-manager:latest

# Resolve the .deb of the latest release, whatever its version
url=$(curl -fsSL https://api.github.com/repos/NeySlim/ultimate-ca-manager/releases/latest \
  | grep '"browser_download_url".*_all\.deb"' | cut -d'"' -f4)

curl -fsSL -o ucm.deb "$url"
sudo apt install ./ucm.deb
sudo systemctl enable --now ucm

# Resolve the .rpm of the latest release, whatever its version
url=$(curl -fsSL https://api.github.com/repos/NeySlim/ultimate-ca-manager/releases/latest \
  | grep '"browser_download_url".*\.noarch\.rpm"' | cut -d'"' -f4)

curl -fsSL -O "$url"
sudo dnf install ./ucm-*.noarch.rpm
sudo systemctl enable --now ucm

git clone https://github.com/NeySlim/ultimate-ca-manager.git
helm install ucm ./ultimate-ca-manager/charts/ucm \
  --namespace ucm --create-namespace

kubectl -n ucm port-forward svc/ucm 8443:8443

Then open https://localhost:8443 and log in with admin / changeme123

A complete PKI platform,
not just a CLI tool.

Everything from your root CA down to network discovery, in one self-hosted app.

CA Hierarchy

Build complete trust chains from the web UI, without openssl gymnastics.

Root & intermediate CAs
Offline, HSM-backed or externally signed
RFC 5280 name constraints
Revoke an intermediate from its parent

Certificate Lifecycle

Issue, sign, renew, revoke and export, in bulk when you need it.

In-place renewal keeps the same ID
PKCS#12, PEM, DER and JKS export
Approval workflows on every path
RFC 5280 / CA-B Forum linting

ACME Server

RFC 8555 with ARI, EAB and named profiles. certbot, acme.sh, Caddy, cert-manager.

Windows Enrollment

Autoenrollment over XCEP/WSTEP, or sign through an existing AD CS.

SCEP & EST

RFC 8894 and RFC 7030, several endpoints, each with its own CA and rules.

Discovery

Scan the network, find every certificate, tell the managed from the rest.

Deploy Hooks

Push a renewed certificate to the host that serves it, over SSH, and reload it.

HSM & Key Recovery

PKCS#11, Azure Key Vault, Cloud KMS. Archived keys come back under four eyes.

SSH CA

Sign user and host keys, ship the trust config as a one-line setup script.

CRL, OCSP & TSA

Delta CRL, delegated OCSP responder, RFC 3161 timestamping.

And more: Templates & issuance policiesTrust store & toolsRBAC & audit chainsPrometheus metricsScheduled PDF reports15+ webhook eventsEncrypted backupsSQLite / PostgreSQLHelm chart9 languagesCommand palette (⌘K)mTLS · WebAuthn · SSOIn-app updates