--- title: ROS 2 Humble security, a tour of the new and improved features description: We’re excited about the recent release of ROS 2 Humble Hawksbill. Let's take a closer look at ROS 2 Humble security features. url: https://canonical.com/blog/ros-2-humble-security-a-tour-of-the-new-and-improved-features?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Florencia Cabral Berenfus](https://canonical.com/blog/author/flor-cabral "More about Florencia Cabral Berenfus") 25 May 2022 # ROS 2 Humble security, a tour of the new and improved features [robotics](https://canonical.com/blog/tag/robotics) [ROS2](https://canonical.com/blog/tag/ros2) [Security](https://canonical.com/blog/tag/security) [SROS2](https://canonical.com/blog/tag/sros2) --- Share the article We’re excited about the recent release of ROS 2 Humble Hawksbill, a Long Term Support (LTS) distro, supported for the next five years. ROS 2 releases come out on every even-numbered year together with the LTS release of Ubuntu, this time with Ubuntu 22.04 (Jammy Jellyfish). Earlier this week, we shared [a step-by-step guide](https://ubuntu.com/blog/install-ros-2-humble-in-ubuntu-20-04-or-18-04-using-lxd-containers) to install ROS 2 Humble in Ubuntu 20.04 or 18.04 using LXD containers, that will allow you to easily install it on your current Ubuntu station. So, take a few minutes to check that out as well! Let’s dive into the new developments available to you when you start using Humble. And if this is the first time you hear about ROS, here is a [good place to start](https://ubuntu.com/robotics/what-is-ros). ## What is new in ROS 2 Humble? ROS 2 Humble Hawksbill. [Image source](https://github.com/ros-infrastructure/artwork/tree/master/distributions/humble) Humble comes with [a host of new code and tutorials](https://docs.ros.org/en/rolling/Releases/Release-Humble-Hawksbill.html). For instance, ‘launch’ incorporated the pytest plugin ‘launch\_pytest’. And when using ‘launch\_ros’ you can now provide ROS-specific node arguments directly, without a leading ‘–ros-args’ flag. ROS 2 Humble also offers new frontend support for composable nodes. Just as exciting are content-filtered topics that allow a more sophisticated subscription to topics. Finally, the ros2cli saw an expansion, with a new  ‘–launch-prefix’ argument. This feature allows passing a prefix to all executables in a launch file, useful in many debugging situations. These are just a few examples of the amazing work the ROS community has done to reach this milestone. But particularly interesting to us are security enhancing developments, as they continuously  increase trust in ROS 2, with each release the most secure one yet. This time, we are seeing yet new enhancements to the security features of ROS with the [addition of Certificate Revocation Lists (CRL) to the SROS2 toolbox](https://docs.ros.org/en/rolling/Releases/Release-Humble-Hawksbill.html#sros2-security-enclaves-now-support-certificate-revocation-lists). Let’s take a closer look at ROS 2 Humble security features. ## What are CRLs, and what can they do for your robot? For those of you [who are new to security in ROS 2](https://ubuntu.com/blog/what-is-sros-2), a reminder that ROS 2 includes tools that help create and load the needed artefacts to enable DDS-security. The [SROS2 package](https://github.com/ros2/sros2) in particular provides the tools and instructions to enable these features. This is a great place to start using these tools on your robot. Specifically, SROS2 introduced the concept of a security “enclave”, defined as a process or group of processes that will share the same identity and access control rules. As in public key infrastructure, the Certificate Authority (CA) acts as a trust anchor, validating the identities and permissions of participants. Again, there is great documentation available to satisfy your technical curiosity of all the elements in ROS 2 security, such as [these tutorials](http://docs.ros.org/en/rolling/Tutorials/Security/Introducing-ros2-security.html). But let us come back to CRL. In short, a Certificate Revocation List (CRL) is a list of digital certificates that have been revoked by the issuing CA before their expiration date. A CRL works essentially as a blocklist of certificates that are no longer trusted. **As of Humble, it is possible to include a CRL with an SROS2 security enclave.** Certificate revocation is an essential component of the certificate process to establish and maintain trust. For example, a certificate can be revoked if its integrity is at risk. This could result from a key being compromised or lost due to modification of privileges, misuse, or termination. ## Try ROS 2 Humble security today Try this new feature for yourself now! This [tutorial](https://github.com/ros2/sros2/blob/master/SROS2_Linux.md#certificate-revocation-lists) follows the usual talker/listener example and will show you exactly how to set up a Certificate Revocation List on your robot today. As always, we would love to hear about your ROS project! [Reach out to us](https://ubuntu.com/robotics#get-in-touch). [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Canonical joins the Open Secure AI Alliance](https://canonical.com/blog/open-secure-ai-alliance) Canonical is now part of the Open Secure AI Alliance, announced by NVIDIA with partners across cloud computing, cybersecurity, enterprise software, open source foundations, and... [Canonical](https://canonical.com/blog/author/canonical) 28 August 2026 [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### DirtyClone Linux kernel local privilege escalation vulnerability fixes available](https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available) On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### pedit COW kernel local privilege escalation vulnerability mitigations](https://canonical.com/blog/pedit-cow-linux-vulnerability-fixes-available) Mitigations are available for the Linux vulnerability with CVE ID CVE-2026-46331. The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE)... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026