Ubuntu Integrates Certificate Revocation Checks into Curl, Plans OpenSSL Support
Ubuntu 26.10 now includes curl with built-in certificate revocation checks, enhancing security by rejecting connections to servers using compromised certificates.
Ubuntu 26.10 has taken a significant step towards bolstering TLS security by integrating certificate revocation checking directly into its curl package. This new feature, derived from the upki project by the rustls developers, ensures that curl will refuse connections to servers presenting certificates that have been revoked by their issuing Certificate Authority (CA) before their scheduled expiry.
Traditionally, tools like OpenSSL, which curl often relies upon, verify the validity of a certificate chain but do not inherently check if any certificate within that chain has been explicitly revoked. This oversight meant that applications using these libraries could continue to trust certificates that browsers, which typically perform more robust checks, had already flagged as untrustworthy. A recent incident involving eight eMudelta intermediate CA certificates with weak private keys highlighted this disparity; while browsers blocked these certificates on October 17th, many other applications continued to trust them until their operating system's CA bundles were updated.
The implementation in Ubuntu 26.10 leverages CRLite, a Mozilla technology for compressing certificate revocation data, similar to what Firefox uses. This approach allows curl to perform revocation checks using a locally stored, compressed list of revoked certificates. Crucially, this method adds no new network requests during the connection process, meaning there is no added latency, and user browsing activity remains private as no external server is contacted to perform the check.
To maintain the freshness of this revocation data, the upki package utilizes a systemd timer that refreshes the list every six hours. For users who wish to enable these checks immediately upon upgrading to Ubuntu 26.10, the revocation data can be downloaded manually by installing the upki package via apt and starting its associated refresh service.
Looking ahead, the Ubuntu Foundations team plans to extend this security enhancement to OpenSSL for the upcoming Ubuntu 27.04 release. Integrating upki into Ubuntu's OpenSSL library would mean that a vast number of applications relying on OpenSSL for their certificate verification would automatically benefit from revocation checking without requiring individual code modifications. This move would represent a substantial leap towards achieving browser-grade certificate verification standards across the entire operating system.
This development marks a critical advancement in securing the software supply chain and protecting users from connections to servers that may have had their digital certificates compromised. By proactively blocking connections to servers with revoked certificates, Ubuntu is enhancing the security posture for its users and setting a precedent for other distributions to follow in adopting more comprehensive TLS security practices.