Ubuntu 26.10 Adds New Security Protection to curl, Blocking Revoked SSL Certificates

Ubuntu 26.10 Stonking Stingray adds certificate revocation checks to curl, helping the command-line tool reject HTTPS connections that use revoked certificates.

Announced on November 10, the change brings upki support into Ubuntu’s curl package. It marks an initial step toward browser-grade certificate checks across the operating system.

The protection closes a gap in how applications check website certificates. Curl uses OpenSSL to verify certificate chains, but that process does not check revocation by default in the setup described by Ubuntu. A certificate could therefore pass those checks even after its issuer had withdrawn it.

According to Ubuntu’s announcement, curl now uses upki-openssl to check server certificates against locally stored revocation data. The system builds on Mozilla’s CRLite technology, which Firefox also uses to identify revoked certificates.

Because the check uses local data, curl does not need an extra network request during each connection. This keeps checks fast and avoids sending a separate revocation query when users visit a site. Background downloads still take place to keep that local data updated.

The upki package is a recommended dependency and includes a systemd timer that refreshes revocation data every six hours. An important limit remains before the first download. Until the data is available, curl continues working as it did before, without the added revocation protection.

Ubuntu 26.10 Adds Protection to curl

Ubuntu demonstrated the difference using a local test server and a test certificate authority. The same curl command accepted a revoked certificate on Ubuntu 26.04 Resolute Raccoon, while Ubuntu 26.10 refused it. The demonstration used unmodified Ubuntu packages for curl, OpenSSL, and upki.

Revocation allows certificate issuers to withdraw trust before a certificate expires. Ubuntu highlighted an October 17 incident involving weak private keys for eight eMudhra intermediate certificate authorities.

According to its account, one private key was simply the number four, creating a risk that attackers could issue certificates for arbitrary websites. Firefox and Chrome blocked those intermediate certificates the same day, while many other applications had to wait for distribution updates.

Ubuntu wants upki to narrow that gap outside browsers. This complements, rather than replaces, regular patching, including fixes covered in Cybersecurity News’ reports on curl security updates and OpenSSL vulnerabilities.

Ubuntu 26.10 users can install the package with sudo apt install upki, then fetch the initial data using sudo systemctl start upki-fetch. service. Running curl https://revoked.badssl.com/ should then fail with curl error 60 and an OpenSSL message stating “certificate revoked (23).” Non-revoked certificates continue working normally.

Administrators should investigate certificate failures rather than bypass verification. The curl documentation strongly warns against using –insecure in production because it turns off peer verification.

For Ubuntu 27.04, the Foundations team plans to integrate upki into OpenSSL’s normal certificate checks. If delivered, that change could extend revocation protection to most of the more than 1,000 packages using OpenSSL directly, without requiring separate changes in every application. That broader coverage remains planned, not part of this initial curl rollout.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Ubuntu 26.10 Adds New Security Protection to curl, Blocking Revoked SSL Certificates appeared first on Cyber Security News.