Skip to content
NewA calmer, faster ZeroHour
StoryToolslow

Ubuntu certificate revocation checks arrive in curl, OpenSSL is next

2 sources · 2 articlesFirst reported Updated ()
Merged summary · from the lead articleSummaries by Vani AI

The check uses local CRLite data via upki, so curl no longer waits on a network revocation lookup.

Ubuntu 26.10 ships curl with certificate revocation checking from upki, a rustls project. Ubuntu 26.04 accepted a revoked certificate that 26.10 refused. The local list is built with Mozilla’s CRLite and refreshed by a systemd timer every six hours; until the first download, curl behaves as before. For Ubuntu 27.04, Foundations plans to put the same check in Ubuntu’s OpenSSL so packages that call OpenSSL directly inherit it.

Key facts
  • On October 17, eight eMudhra intermediate CA keys were found weak, one equal to the number 4.
  • Firefox and Chrome blocked those eight certificates the same day.
  • Many non-browser apps kept trusting them until ca-certificates updates shipped.
  • Users can install upki with apt and start the fetch service immediately.
  • More than 1,000 packages use OpenSSL directly, the post says.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Vendors
Ubuntu
Products
curlOpenSSLupkiUbuntu 26.10
Organizations
Mozilla

Coverage

oldest first · one row per article · UTC
  1. · 11h ago Help Net SecurityFirst report

    Ubuntu 26.10 curl checks certificate revocation; OpenSSL is next

    The check uses local CRLite data via upki, so curl no longer waits on a network revocation lookup.

  2. · 3h ago Cyber Security News

    Ubuntu 26.10 curl rejects HTTPS sites using revoked certificates

    upki checks local CRLite data every six hours; revocation protection stays off until the first download completes.