[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fs2iwmAo20-QtIyBcpxmsOfVR_j4OYk7SZbvJroYQ1SE":3},{"article":4,"iocs":52,"watch_terms":53,"solutions":54,"lesson":57},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"3ef07c80-66f8-4335-ac47-08abc481334e","Ubuntu certificate revocation checks arrive in curl, OpenSSL is next","ubuntu-certificate-revocation-checks-arrive-in-curl-openssl-is-next-f3b84e","Ubuntu 26.10 ships curl with certificate revocation checking built in. The check comes from upki, a project from the rustls developers. Ubuntu’s developers ran the same curl command on both releases: Ubuntu 26.04 accepted a revoked certificate and connected, while 26.10 refused it. A certificate authority revokes a certificate when it should stop being trusted before it expires. OpenSSL checks a certificate chain by default, but it doesn’t check whether any certificate in that chain … More → The post Ubuntu certificate revocation checks arrive in curl, OpenSSL is next appeared first on Help Net Security.","Ubuntu 26.10 has integrated certificate revocation checking into its curl package, a feature derived from the upki project by rustls developers. This enhancement prevents curl from connecting to sites using revoked certificates, a vulnerability that previously affected non-browser tools. OpenSSL is slated to receive similar checks in Ubuntu 27.04, extending this security measure to over a thousand packages.","Ubuntu 26.10 now checks for revoked certificates in curl, with OpenSSL support planned.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F11\u002Fubuntu-certificate-revocation-curl-openssl\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002F11060336\u002Fubuntu-1500.webp","2026-11-11T09:46:23+00:00","2026-11-11T10:00:13.287961+00:00",7,[17,20,22,24,26],{"name":18,"type":19},"curl","product",{"name":21,"type":19},"OpenSSL",{"name":23,"type":19},"Firefox",{"name":25,"type":19},"Chrome",{"name":27,"type":28},"CRLite","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,45,50],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":51},{"id":29,"icon":31,"name":32,"slug":33},[],[18,21,23],{"controls":55,"vendors":56},[],[],{"slug":58,"title":59,"body":60,"framework_refs":61,"framework_notes":67},"non-browser-tools-blind-to-revoked-certificates-ubuntu-closes-the-gap","Non-Browser Tools Blind to Revoked Certificates: Ubuntu Closes the Gap","For years, certificate revocation checking was largely confined to web browsers, leaving command-line tools like curl and libraries like OpenSSL silently accepting revoked certificates as valid. This meant that if a certificate was compromised and revoked, attackers could still exploit it against any application relying on these tools without triggering a warning. Ubuntu's integration of revocation checking into curl (and soon OpenSSL) closes a significant blind spot affecting thousands of packages. The lesson is that security controls cannot be assumed to exist simply because they exist in one context — each toolchain and runtime environment must be explicitly audited and hardened. Failing to enforce revocation checks creates a window where stolen or compromised certificates remain usable, undermining the entire PKI trust model.",[62,63,64,65,66],"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","NIST SP 800-53 SC-17: Public Key Infrastructure Certificates","NIST CSF 2.0 PR.PS-01: Configuration Management","NIS2 Article 21(2)(e)","OWASP A02:2021 Cryptographic Failures",{"NIS2 Article 21(2)(e)":68,"OWASP A02:2021 Cryptographic Failures":69,"NIST CSF 2.0 PR.PS-01: Configuration Management":70,"NIST SP 800-53 SC-17: Public Key Infrastructure Certificates":71,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":72},"This point covers security in acquisition, development, and maintenance including vulnerability handling, which directly applies to the failure to extend revocation checking to non-browser tools during their development and maintenance lifecycle.","OWASP A02 covers failures in cryptographic mechanisms including improper certificate validation, and skipping revocation checks allows a revoked certificate to be treated as trustworthy, which is a cryptographic failure.","PR.PS-01 asks that software configuration be established and maintained to reduce risk, and the absence of revocation checking in non-browser TLS clients was a misconfiguration that left systems exposed.","SC-17 requires organizations to manage PKI certificates including validating their revocation status, which is what curl and OpenSSL failed to do before this fix.","CIS Control 4 requires that software be configured securely by default; enabling certificate revocation checking in curl and OpenSSL is exactly the kind of secure baseline configuration it mandates."]