upki

More on upki: https://discourse.ubuntu.com/t/an-update-on-upki/77063 My interest in building OneCRL support into upki has definitely increased this week. Issue: https://github.com/rustls/upki/issues/229 I'm hoping some organizations will step forward to fund work on this. (Note that curl on Ubuntu 26.10 now has CRLite support baked via upki -- unfortunately that doesn't help with this because AIUI CRLite is only for end entities, not for intermediate certificates.)

The impact of this incident is very unevenly spread. Over 10 years ago, Mozilla shipped OneCRL [1]. We remediated this incident in a couple of hours for Firefox users who were protected automatically without the need for updates. Chrome, Apple and Microsoft have similar tooling. Since then, we've built more advanced tooling to handle revocation at scale for leaf certs (CRLite [2]). However, for the rest of the ecosystem, there has been little to no investment in revocation and for those clients, this is a massive problem. Hopefully, we'll see folks invest now. Efforts like upki [3] look promising. [1] https://blog.mozilla.org/security/2015/03/03/revoking-interm... [2] https://hacks.mozilla.org/2025/08/crlite-fast-private-and-co... [3] https://github.com/rustls/upki

On Linux and similar systems, I'm hoping github.com/rustls/upki will handle landmark distribution, and that non-browser clients can use that. Of course Rustls will support their own project, but I'm hopeful other TLS stacks do too. Ubuntu announcing they're deploying it should help with that. On other OSes (like Mac OS and Windows), there's also OS-level services which could support this. It would be a shame if we end up with a bunch of copies of this data, so I think a shared OS service is the only reasonable approach. The hardest part is going to be smaller embedded systems.