Ubuntu 26.10, which shipped in October, has begun rolling out upki for certificate revocation, Phoronix reports. Canonical wants browser-grade certificate checks, including revocation, across the OS stack. upki comes from the Rustls project, builds on Mozilla’s work, and can plug into OpenSSL, Rustls and a C-FFI interface.
The project only settled in September, so 26.10 enables it for the curl package first. The plan is to use it in OpenSSL itself for 27.04. Canonical points to October’s eMudhra intermediate-CA mess as one reason faster, stack-wide revocation matters. I covered that Cisco distrust advisory last week.
My take
Revocation only helps if the whole stack actually checks it. Starting with curl is modest, but it’s the right direction.
God Bless, and Happy hacking!
