Ubuntu 26.10 ships with initial upki support

Ubuntu 26.10 introduces an initial step toward system-wide, browser-grade certificate revocation checking: its curl package uses upki-openssl to compare a server’s certificate against locally stored revocation data. In a demonstration using a test certificate authority and Mozilla CRLite tools, curl on Ubuntu 26.04 accepts a revoked certificate, while the same command on 26.10 rejects it. Checks require no extra network request, preserving speed and privacy. The recommended upki package refreshes revocation data in the background every six hours; until the initial data download completes, curl behaves as before. Users can install upki, run its fetch service, and test revoked certificates with curl.

The change addresses the risk that compromised certificate authorities can issue certificates for any website, while revocation updates may reach browsers faster than other software. On October 17, 2026, a researcher discovered cryptographically weak private keys for eight eMudhra intermediate certificates, including one whose key was the number 4. Firefox and Chrome blocked the certificates that day, but many other applications depended on slower distribution updates to ca-certificates. Ubuntu’s longer-term aim is to make OpenSSL itself consult upki data, planned for release 27.04. That would extend revocation checks to more than 1,000 packages that use OpenSSL directly, without requiring each package to be modified.