Go Emergency Updates Block Eight Certificate Authority Keys
Summary
Go 1.27.3 and 1.26.10 block certificate chains using eight intermediate keys over undisclosed security concerns. A commenter matched the keys to eMudhra certificates, but The Hacker News did not independently verify the match.
Key points
- Released October 20, Go 1.27.3 and 1.26.10 make Go's verifier reject certificate chains containing any of eight specified public keys.
- The Go team says the keys belong to an unnamed certificate authority and cites specific security concerns about its operation, without explaining what happened.
- A commenter matched the hashes Go published to eMudhra intermediates; The Hacker News says it did not independently verify the match.
- Mozilla added six certificates issued under eMudhra's emSign Root TLS CA - G3 to Firefox's OneCRL on October 17, but the reason for the action is not public.
- The key filter also applies when verification is delegated to macOS or Windows, and the article says it cannot be disabled, including for deployments with custom trusted roots.
- Programs must be rebuilt with a supported Go release to receive the change; services using the affected keys need certificates issued under a different intermediate.
Article Details
- Event Type
- Emergency security update blocking certificate authority public keys
- Impact
- Go 1.27.3 and Go 1.26.10 reject certificate chains containing any of eight intermediate CA public keys, preventing rebuilt Go clients from connecting to sites or services using certificates issued under those keys. The filter also affects custom trusted-root configurations and cannot be disabled. A commenter matched the keys to eMudhra intermediates, but The Hacker News had not independently verified that match; the underlying security concerns and the CA’s identity were not disclosed by Go.