Ubuntu 26.10 curl checks certificate revocation; OpenSSL is next
Original title: Ubuntu certificate revocation checks arrive in curl, OpenSSL is next
The check uses local CRLite data via upki, so curl no longer waits on a network revocation lookup.
Ubuntu 26.10 ships curl with certificate revocation checking from upki, a rustls project. Ubuntu 26.04 accepted a revoked certificate that 26.10 refused. The local list is built with Mozilla’s CRLite and refreshed by a systemd timer every six hours; until the first download, curl behaves as before. For Ubuntu 27.04, Foundations plans to put the same check in Ubuntu’s OpenSSL so packages that call OpenSSL directly inherit it.
Unconfirmed: OpenSSL integration is a plan for Ubuntu 27.04, not a shipped release.
- On October 17, eight eMudhra intermediate CA keys were found weak, one equal to the number 4.
- Firefox and Chrome blocked those eight certificates the same day.
- Many non-browser apps kept trusting them until ca-certificates updates shipped.
- Users can install upki with apt and start the fetch service immediately.
- More than 1,000 packages use OpenSSL directly, the post says.
Impact: Non-browser tools can trust certificates browsers have already revoked
| Product | Affected | Fixed in |
|---|---|---|
| Ubuntu curl | Ubuntu 26.04 accepted a revoked certificate | Ubuntu 26.10 |
- 1.On Ubuntu 26.10, install upki and start its fetch service to enable the check before the first timer run.
From the original article
1 min read at helpnetsecurity.com
Ubuntu 26. 10 ships curl with certificate revocation checking built in. The check comes from upki, a project from the rustls developers.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.