Ubuntu 26.10 begins rolling out Rust-based upki certificate revocation support

Ubuntu 26.10, released in October, has begun deploying upki support for certificate revocation, initially limited to the curl package due to the project's late September finalization. Canonical is adopting upki from the Rustls project to provide browser-grade certificate verification and revocation capabilities written in Rust, building on foundational work by Mozilla. The system checks revocation status for certificates from publicly-trusted authorities and integrates with OpenSSL, Rustls, and offers a C-FFI interface.

The initial narrow scope for Ubuntu 26.10 reflects the compressed timeline, with broader deployment planned for Ubuntu 27.04 where upki will be integrated into the OpenSSL package for certificate verification. Canonical accelerated this initiative following the October eMudhra exposure, where researchers discovered weak private keys for intermediate CA certificates, demonstrating the need for faster, stack-wide revocation mechanisms.

upki architecture and Ubuntu deployment path

• Rust-based implementation: upki is written in Rust and originates from the Rustls project, providing memory-safety guarantees for certificate infrastructure code.
• Multi-library integration: The project interfaces with OpenSSL, Rustls, and exposes a C-FFI interface for broader ecosystem compatibility.
• Mozilla-derived verification: upki builds upon Mozilla's foundational certificate work to check revocation status for publicly-trusted certificate authorities.
• Phased Ubuntu rollout: Ubuntu 26.10 enables upki only for curl; Ubuntu 27.04 will extend support to the OpenSSL package for system-wide certificate verification.
• Response to eMudhra CA exposure: The deployment was prioritized after weak private keys were found in intermediate CA certificates from eMudhra in October 2026.

Why it matters

For Linux distributions and system administrators, upki represents a shift toward Rust-implemented, browser-grade security infrastructure that could reduce exposure to certificate authority compromises. The phased Ubuntu approach provides a testbed for other distributions considering similar moves, while the OpenSSL integration in 27.04 will affect virtually all TLS-dependent applications on the platform. This also signals growing production adoption of Rust in core Linux security components beyond individual applications.