Ubuntu 26.10 introduces a key security update to its curl package that empowers it to reject HTTPS connections presenting revoked SSL certificates. The feature, announced on November 10, integrates Ubuntu Public Key Infrastructure (UPKI) support into curl, allowing the tool to compare server certificates against locally stored revocation data rather than relying solely on the traditional OpenSSL chain verification—which until now did not verify whether a certificate had been revoked.
How the new protection works
The new behavior stems from integrating the upki-openssl system into curl, enabling it to validate certificates using revocation information stored on the system. This local data model is based on Mozilla’s CRLite technology, which already powers certificate revocation checks in Firefox. Because the revocation lists are maintained locally, curl doesn’t need to make additional network requests for each HTTPS connection, keeping performance intact. A system service regularly updates this data every six hours through a systemd timer.
What Ubuntu says and future plans
This change addresses a previously ignored risk: even certificates that have been revoked would still pass OpenSSL’s verification process on Ubuntu without explicit revocation checks. Ubuntu demonstrated the difference by showing that on version 26.04 the same curl command accepted a revoked certificate, while version 26.10 rejected it when using unmodified packages.
The initiative responds in part to incidents such as an October event involving weak private keys for eight intermediate certificate authorities managed by eMudhra, some of which were compromised due to extremely simple keys. While browsers like Firefox and Chrome quickly blocked those keys, many other systems continued trusting them until updates arrived.
To activate the new curl behavior, users can install the upki package, then initiate data fetching via sudo systemctl start upki-fetch.service. Afterwards, curl should reject revoked certificates with an error 60 (“certificate revoked (23)”), while still accepting valid ones. Ubuntu cautions administrators against bypassing verification with flags like “–insecure”, recommending investigations into failures instead.
Looking ahead, Ubuntu’s Foundations team intends to build revocation checking into OpenSSL’s default certificate verification flow in Ubuntu 27.04. If implemented, this could extend protection across more than a thousand packages that depend directly on OpenSSL without needing changes per application, offering system-wide coverage.
This update represents a meaningful step in reducing the gap between browser security and system-level protections. Adding revocation checking to command-line tools like curl strengthens defenses against misissued or compromised certificates. With broader OpenSSL integration planned, 26.10 lays the groundwork—but administrators need to deploy and monitor UPKI carefully to fully benefit.
