Ubuntu 26.10 ships curl with certificate revocation checking built in. The check comes from upki, a project from the rustls developers. Ubuntu’s developers ran the same curl command on both releases: Ubuntu 26.04 accepted a revoked certificate and connected, while 26.10 refused it. A certificate authority revokes a certificate when it should stop being trusted before it expires. OpenSSL checks a certificate chain by default, but it doesn’t check whether any certificate in that chain … More
Source: Help Net Security · 2026-11-11