Ubuntu 26.10 Stonking Stingray has introduced a significant security enhancement to the curl tool by implementing certificate revocation checks. This update ensures that HTTPS connections using revoked certificates are rejected, marking a pivotal step towards more secure browsing across the operating system.
Introduction of upki Support
On November 10, Ubuntu announced the integration of upki support into its curl package. This advancement aims to elevate certificate validation to a browser-level standard within the OS. Prior to this, curl relied solely on OpenSSL for verifying certificate chains, a process that did not automatically include revocation checks. This gap meant certificates could pass even if their issuers had retracted them.
With the new update, curl now leverages upki-openssl to verify server certificates against locally stored revocation data. This system is built on Mozilla’s CRLite technology, which is also utilized by Firefox to identify revoked certificates. As a result, curl can perform these checks rapidly without requiring additional network requests.
Efficiency and Implementation
The revocation checks are designed to be efficient, using local data to avoid extra network overhead. Background downloads ensure that this local data stays current, refreshing every six hours through a systemd timer included with the upki package. However, until the initial data download is completed, curl operates as before, without the added revocation protection.
To demonstrate this capability, Ubuntu showcased a scenario using a local test server. In this test, Ubuntu 26.10 successfully blocked a revoked certificate, whereas the previous version, Ubuntu 26.04 Resolute Raccoon, did not. This demonstration used standard Ubuntu packages for curl, OpenSSL, and upki.
Future Outlook and Broader Implications
Certificate revocation is crucial as it allows issuers to withdraw trust in a certificate prior to its expiration. Ubuntu cited an incident on October 17 involving weak private keys in eight eMudhra intermediate certificate authorities. Firefox and Chrome quickly blocked these certificates, but other applications had to wait for updates. Ubuntu’s introduction of upki aims to close this gap beyond web browsers, complementing existing security updates.
Looking ahead, Ubuntu plans to integrate upki into OpenSSL’s standard certificate checks for its next release, Ubuntu 27.04. This could extend revocation protection to a vast array of applications using OpenSSL, enhancing security without necessitating individual application updates.
Administrators are advised to investigate certificate failures rather than bypass verification processes. The curl documentation cautions against using the –insecure option in production, as it disables peer verification and undermines security.
