[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAUu68G5pLqJnfPiBlq5Qj-rOlFGsVhVQ4Pah0N0-dik":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"b0083cd8-7b70-474c-ad22-f651073dd247","non-browser-tools-blind-to-revoked-certificates-ubuntu-closes-the-gap","3ef07c80-66f8-4335-ac47-08abc481334e","Non-Browser Tools Blind to Revoked Certificates: Ubuntu Closes the Gap","For years, certificate revocation checking was largely confined to web browsers, leaving command-line tools like curl and libraries like OpenSSL silently accepting revoked certificates as valid. This meant that if a certificate was compromised and revoked, attackers could still exploit it against any application relying on these tools without triggering a warning. Ubuntu's integration of revocation checking into curl (and soon OpenSSL) closes a significant blind spot affecting thousands of packages. The lesson is that security controls cannot be assumed to exist simply because they exist in one context — each toolchain and runtime environment must be explicitly audited and hardened. Failing to enforce revocation checks creates a window where stolen or compromised certificates remain usable, undermining the entire PKI trust model.","**Immediate actions:**\n- Audit all non-browser TLS clients (curl, wget, language HTTP libraries) in your environment to confirm whether certificate revocation checking (CRL\u002FOCSP) is enabled.\n- Upgrade Ubuntu-based systems to versions that include the hardened curl package, and schedule OpenSSL-dependent packages for upgrade when Ubuntu 27.04 ships.\n\n**Long-term improvements:**\n- Establish a baseline security configuration standard for all TLS clients that explicitly requires revocation checking and document exceptions.\n- Maintain an inventory of every package and library that performs TLS connections so that gaps in PKI enforcement can be systematically identified and tracked.\n- Integrate automated TLS configuration scanning into your CI\u002FCD pipeline to catch newly introduced clients that lack revocation enforcement.\n\n**Detection measures:**\n- Deploy network-level monitoring or a TLS inspection proxy to log and alert on connections using certificates that appear on known CRLs or fail OCSP validation.\n- Subscribe to OS and upstream library security advisories so that PKI-related improvements and vulnerability disclosures trigger a timely internal review.",[12,13,14,15,16],"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","NIST SP 800-53 SC-17: Public Key Infrastructure Certificates","NIST CSF 2.0 PR.PS-01: Configuration Management","NIS2 Article 21(2)(e)","OWASP A02:2021 Cryptographic Failures",{"NIS2 Article 21(2)(e)":18,"OWASP A02:2021 Cryptographic Failures":19,"NIST CSF 2.0 PR.PS-01: Configuration Management":20,"NIST SP 800-53 SC-17: Public Key Infrastructure Certificates":21,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":22},"This point covers security in acquisition, development, and maintenance including vulnerability handling, which directly applies to the failure to extend revocation checking to non-browser tools during their development and maintenance lifecycle.","OWASP A02 covers failures in cryptographic mechanisms including improper certificate validation, and skipping revocation checks allows a revoked certificate to be treated as trustworthy, which is a cryptographic failure.","PR.PS-01 asks that software configuration be established and maintained to reduce risk, and the absence of revocation checking in non-browser TLS clients was a misconfiguration that left systems exposed.","SC-17 requires organizations to manage PKI certificates including validating their revocation status, which is what curl and OpenSSL failed to do before this fix.","CIS Control 4 requires that software be configured securely by default; enabling certificate revocation checking in curl and OpenSSL is exactly the kind of secure baseline configuration it mandates.","published","2026-11-11T10:20:26.858836+00:00","2026-11-11T10:20:26.838+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F11\u002Fubuntu-certificate-revocation-curl-openssl\u002F","ubuntu-certificate-revocation-checks-arrive-in-curl-openssl-is-next-f3b84e","Ubuntu certificate revocation checks arrive in curl, OpenSSL is next",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[]]