Ubuntu 26.10 curl rejects HTTPS sites using revoked certificates
Original title: Ubuntu 26.10 Adds New Security Protection to curl, Blocking Revoked SSL Certificates
upki checks local CRLite data every six hours; revocation protection stays off until the first download completes.
Ubuntu 26.10, announced November 10, adds upki support to its curl package so HTTPS connections are checked against locally stored certificate revocation data. Curl’s OpenSSL chain checks do not consult revocation by default, so a withdrawn certificate could still be accepted. upki is a recommended dependency with a systemd timer that refreshes data every six hours, and it does not add a network query on each connection. Until that data exists, curl behaves as before. Ubuntu showed 26.10 refusing a revoked test certificate that Ubuntu 26.04 accepted.
Unconfirmed: The eMudhra private-key details are Ubuntu’s account; extending upki to most OpenSSL packages is only planned for 27.04.
- A demo with stock packages refused a revoked certificate on 26.10 but not 26.04.
- Users can install upki and start upki-fetch.service to load the first dataset.
- curl https://revoked.badssl.com/ should then fail with error 60, “certificate revoked (23).”
- Ubuntu cited an October 17 case of weak keys for eight eMudhra intermediate CAs.
- Integration of upki into OpenSSL checks is planned for Ubuntu 27.04, not this release.
- 1.Install upki and start upki-fetch.service so curl has local revocation data.
- 2.Expect curl error 60 on https://revoked.badssl.com/ after the data is loaded.
- 3.Do not bypass certificate failures with curl --insecure in production.
From the original article
2 min read at cybersecuritynews.com
Ubuntu 26. 10 Stonking Stingray adds certificate revocation checks to curl, helping the command-line tool reject HTTPS connections that use revoked certificates. Announced on November 10, the change brings upki support into Ubuntu’s curl package.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.