Ubuntu 26.10 Begins Rolling Out upki Support For Certificate Revocation

With Ubuntu 26.10 that shipped in October there is a little talked about feature with upki revocation support beginning to roll out. Due to the late change, upki for certificate revocation was only enabled for Ubuntu 26.10's curl package but with more plans ahead. Canonical is working toward browser-grade certificate verification (and revocation where needed) across the entire operating system stack. Canonical is pursuing the upki project from the Rustls project to provide the browser-grade certificate infrastructure written in Rust. This builds upon the foundational work done by Mozilla and checks the revocation status for certificates issued by publicly-trusted authorities. The upki project integrates with OpenSSL, Rustls, and has a C-FFI interface. Ubuntu 26.10 wanted to enable upki by default but as it only settled in September, they limited their initial scope to enabling it for their curl package. With Ubuntu 27.04, developers plan to make use of upki in the OpenSSL package for certificate verification. Canonical is pushing the need for this certificate verification/revocation support given the eMudhra exposure in October where a researcher found private keys for the intermediate CA certificates being weak. With upki is a much quicker path to revoking them across the stack. More details for those interested via the Ubuntu Discourse.