Go 1.27.3 and 1.26.10 block eight CA keys
Original title: Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns
Rebuilt Go programs reject chains through the keys, with no disable switch, and older unsupported releases get no fix.
Go 1.27.3 and Go 1.26.10, released October 20, make Go’s certificate verifier reject chains that pass through eight intermediate certificate-authority keys. The Go team says the keys belong to one unnamed authority and cites specific security concerns, handling the change on its URGENT track. A commenter matched all eight hashes to eMudhra intermediates; The Hacker News has not independently verified that match. Two days earlier, Mozilla added six eMudhra emSign intermediates to OneCRL. Go 1.25 and older are unsupported, and sites using the blocked keys need certificates from another intermediate.
Unconfirmed: Go has not named the authority or the concern; the eMudhra hash match is a commenter’s and was not independently checked by The Hacker News.
- The filter hashes each certificate’s public key, catching cross-signed copies.
- Rejected chains return “x509: no valid chains built.”
- The filter also applies when a program supplies its own trusted roots.
- Mozilla’s related bug is closed to the public.
- Go has not said which URGENT-track condition applied.
Impact: Go clients refuse TLS chains passing through eight blocked CA keys
| Product | Affected | Fixed in |
|---|---|---|
| Go | releases before Go 1.27.3 and Go 1.26.10; Go 1.25 and older unsupported | 1.27.3 and 1.26.10 |
- 1.Upgrade supported Go programs to 1.27.3 or 1.26.10 and rebuild them.
- 2.Replace certificates that chain through the eight blocked intermediate keys.
From the original article
4 min read at thehackernews.com
Go 1. 27. 3 and Go 1.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.