Ubuntu certificate revocation checks arrive in curl, OpenSSL is next
Ubuntu 26.10 ships curl with certificate revocation checking built in, and the check comes from upki, a project from the rustls developers.
Ubuntu 26.10 ships curl with certificate revocation checking built in, and the check comes from upki, a project from the rustls developers.
Ubuntu’s developers ran the same curl command on both releases: Ubuntu 26.04 accepted a revoked certificate and connected, while 26.10 refused it.
On October 17, a researcher found that the private keys behind eight eMudhra intermediate CA certificates were weak, and most other applications kept trusting them until distributions shipped updated ca-certificates packages.
For Ubuntu 27.04, the Foundations team plans to build upki into Ubuntu’s OpenSSL, so normal certificate verification would also check the revocation data.
Anyone holding a key like that could issue a certificate for any website, and in 26.10, curl compares the server’s certificate against a list of revoked certificates stored on the machine.
OpenSSL checks a certificate chain by default, but it doesn’t check whether any certificate in that chain was revoked; that leaves curl and other non-browser tools that rely on it trusting certificates that browsers have already blocked.
A certificate authority revokes a certificate when it should stop being trusted before it expires, and firefox and Chrome blocked the eight certificates the same day.
What happened
Ubuntu 26.10 ships curl with certificate revocation checking built in, and the check comes from upki, a project from the rustls developers.
Ubuntu’s developers ran the same curl command on both releases: Ubuntu 26.04 accepted a revoked certificate and connected, while 26.10 refused it.
What changed
On October 17, a researcher found that the private keys behind eight eMudhra intermediate CA certificates were weak, and most other applications kept trusting them until distributions shipped updated ca-certificates packages.
For Ubuntu 27.04, the Foundations team plans to build upki into Ubuntu’s OpenSSL, so normal certificate verification would also check the revocation data.
Who is affected
Anyone holding a key like that could issue a certificate for any website, and in 26.10, curl compares the server’s certificate against a list of revoked certificates stored on the machine.
Response
OpenSSL checks a certificate chain by default, but it doesn’t check whether any certificate in that chain was revoked; that leaves curl and other non-browser tools that rely on it trusting certificates that browsers have already blocked.
What security teams should do
A certificate authority revokes a certificate when it should stop being trusted before it expires, and firefox and Chrome blocked the eight certificates the same day.
What to watch next
Watch for revised vendor guidance, fixed versions and mitigation updates.