Ubuntu certificate revocation checks arrive in curl, OpenSSL is next - Help Net Security
Ubuntu 26.10 ships curl with certificate revocation checking built in. The check comes from upki, a project from the rustls developers. Ubuntu’s developers ran the same curl command on both releases: Ubuntu 26.04 accepted a revoked certificate and connected, while 26.10 refused it.
A certificate authority revokes a certificate when it should stop being trusted before it expires. OpenSSL checks a certificate chain by default, but it doesn’t check whether any certificate in that chain was revoked. That leaves curl and other non-browser tools that rely on it trusting certificates that browsers have already blocked.
Linha do tempo
-
Ubuntu certificate revocation checks arrive in curl, OpenSSL is next - Help Net Security
ler a análise desta fonte ocultar
Ubuntu 26.10 ships curl with certificate revocation checking built in. The check comes from upki, a project from the rustls developers. Ubuntu’s developers ran the same curl command on both releases: Ubuntu 26.04 accepted a revoked certificate and connected, while 26.10 refused it.
A certificate authority revokes a certificate when it should stop being trusted before it expires. OpenSSL checks a certificate chain by default, but it doesn’t check whether any certificate in that chain was revoked. That leaves curl and other non-browser tools that rely on it trusting certificates that browsers have already blocked.