Ubuntu certificate revocation checks arrive in curl, OpenSSL is next
Ubuntu 26.10 ships curl with certificate revocation checking built in. The check comes from upki, a project from the rustls developers. Ubuntu’s developers ran the same curl command on both releases: Ubuntu 26.04 accepted a revoked certificate and connected, while 26.10 refused it.
A certificate authority revokes a certificate when it should stop being trusted before it expires. OpenSSL checks a certificate chain by default, but it doesn’t check whether any certificate in that chain was revoked. That leaves curl and other non-browser tools that rely on it trusting certificates that browsers have already blocked.
Eight weak keys in October
On October 17, a researcher found that the private keys behind eight eMudhra intermediate CA certificates were weak. One of them was the number 4. Anyone holding a key like that could issue a certificate for any website. Firefox and Chrome blocked the eight certificates the same day. Most other applications kept trusting them until distributions shipped updated ca-certificates packages.
How the check works
In 26.10, curl compares the server’s certificate against a list of revoked certificates stored on the machine. That list is built with CRLite, Mozilla’s method for compressing revocation data, and Firefox uses the same technology. Because the data is already local, the check adds no network requests. Your connection doesn’t wait on a lookup, and no outside server sees which sites you visit.
The upki package uses a systemd timer to refresh the data every six hours. Until the first download finishes, curl behaves as it did before. If you want the check working right away, install upki with apt and start the fetch service yourself.
OpenSSL is next
For Ubuntu 27.04, the Foundations team plans to build upki into Ubuntu’s OpenSSL, so normal certificate verification would also check the revocation data. Most of the more than 1,000 packages that use OpenSSL directly would then get the check without changing their code. Until that lands, the check in 26.10 covers curl, which the post calls the very first step towards browser-grade certificate verification across the entire OS.
