Ubuntu 26.10 Adds New Security Protection to curl, Blocking Revoked SSL Certificates
Ubuntu 26.10 adds certificate revocation checks to curl, blocking connections with revoked SSL certificates.
Ubuntu 26.10 "Stonking Stingray" now includes certificate revocation checks for curl, enhancing security by rejecting HTTPS connections that use revoked SSL certificates. This integration utilizes upki-openssl and Mozilla's CRLite technology, allowing curl to check against local revocation data without requiring additional network requests. The feature aims to close a security gap by providing browser-grade certificate checks to applications beyond web browsers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run curl?
Get an email when a new story names curl, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonFor years, curl — one of the most widely used command-line HTTP tools — did not perform certificate revocation checks by default, meaning it would happily accept HTTPS connections using certificates that had been revoked due to compromise or misissuance. This gap left server-side applications, scripts, and automation pipelines exposed to man-in-the-middle attacks involving revoked certificates that browsers would have rejected outright. Ubuntu 26.10 addresses this by integrating Mozilla's CRLite technology and upki-openssl, enabling local revocation checks without extra network overhead. The lesson is that security defaults matter: tools trusted by developers and administrators must enforce the same cryptographic hygiene that end-user browsers do, and OS vendors have a responsibility to ship secure-by-default configurations.
What helps against this
How we list vendors- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.