Go will reject certificate chains containing eight distrusted SPKIs

crypto/x509: mitigation for security concerns with a specific Certificate Authority #82345 Description We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation. Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller. We highly recommend immediately upgrading to this release. This is CVE-2026-111943 and Go issue https://go.dev/issue/82345. This was an URGENT track issue originally tracked in http://b/575512169. Activity thatnealpatel added this to the Go1.28 milestone on Oct 19, 2026 thatnealpatel added Security release-blocker on Oct 19, 2026 thatnealpatel commented on Oct 19, 2026 thatnealpatel on Oct 19, 2026 Last edited by dmitshur MemberAuthor More actions @gopherbot Please open backports for this issue. thatnealpatel commented on Oct 19, 2026 @gopherbot Please open backports for this issue. gopherbot commented on Oct 19, 2026 gopherbot on Oct 19, 2026 Contributor More actions Backport issue(s) opened: #82348 (for 1.26), #82349 (for 1.27). Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases. gopherbot commented on Oct 19, 2026 Backport issue(s) opened: #82348 (for 1.26), #82349 (for 1.27). Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases. gopherbot added 2 commits that reference this issue on Oct 20, 2026 [release-branch.go1.26] crypto/x509: distrust a handful of intermediates ... aa64342 [release-branch.go1.27] crypto/x509: distrust a handful of intermediates ... 90617fb [release-branch.go1.26] crypto/x509: distrust a handful of intermediates [release-branch.go1.27] crypto/x509: distrust a handful of intermediates gopherbot commented on Oct 20, 2026 gopherbot on Oct 20, 2026 Contributor More actions Change https://go.dev/cl/851165 mentions this issue: [release-branch.go1.27] crypto/x509: distrust a handful of intermediates gopherbot commented on Oct 20, 2026 Change https://go.dev/cl/851165 mentions this issue: [release-branch.go1.27] crypto/x509: distrust a handful of intermediates gopherbot commented on Oct 20, 2026 gopherbot on Oct 20, 2026 Contributor More actions Change https://go.dev/cl/851145 mentions this issue: [release-branch.go1.26] crypto/x509: distrust a handful of intermediates gopherbot commented on Oct 20, 2026 Change https://go.dev/cl/851145 mentions this issue: [release-branch.go1.26] crypto/x509: distrust a handful of intermediates gopherbot commented on Oct 20, 2026 gopherbot on Oct 20, 2026 Contributor More actions Change https://go.dev/cl/851047 mentions this issue: crypto/x509: distrust a handful of intermediates gopherbot commented on Oct 20, 2026 Change https://go.dev/cl/851047 mentions this issue: crypto/x509: distrust a handful of intermediates thatnealpatel changed the title [-]security: fix CVE-2026-111943[/-] [+]crypto/x509: mitigation for security concerns with a specific Certificate Authority[/+] on Oct 20, 2026 gopherbot added a commit that references this issue on Oct 20, 2026 crypto/x509: distrust a handful of intermediates ... 7f86f95 crypto/x509: distrust a handful of intermediates thatnealpatel closed this as completedon Oct 20, 2026 chenxiaolong added 2 commits that reference this issue on Oct 20, 2026 external/go: Update to go1.27.3 ... 0e623cf external/go: Update to go1.27.3 ... 06bfbc8 external/go: Update to go1.27.3 external/go: Update to go1.27.3 zhangyoufu commented on Oct 20, 2026 zhangyoufu on Oct 20, 2026 Contributor More actions ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105 https://platform.censys.io/certificates/42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493 Subject DN C=NL, O=eMudhra BV, CN=EM DV TLS CA - G3B Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3 49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f https://platform.censys.io/certificates/0164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19 Subject DN C=US, O=eMudhra Inc, CN=EM DV TLS CA - G3C Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3 e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41 https://platform.censys.io/certificates/e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838 Subject DN C=NL, O=eMudhra BV, CN=EM EV TLS CA - G3B Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3 5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0 https://platform.censys.io/certificates/432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3 Subject DN C=US, O=eMudhra Inc, CN=EM EV TLS CA - G3C Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3 43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b https://platform.censys.io/certificates/98b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b Subject DN C=NL, O=eMudhra BV, CN=EM OV TLS CA - G3B Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3 63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8 https://platform.censys.io/certificates/cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3f Subject DN C=US, O=eMudhra Inc, CN=EM OV TLS CA - G3C Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3 ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6 https://platform.censys.io/certificates/9e39de2881273acc225a149c72ba3e0f51424963669ab633ee1dc7df5db067b4 Subject DN C=NL, O=eMudhra BV, CN=EM OV CS CA - G3B Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root CS CA - G3 92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30 https://platform.censys.io/certificates/4b2460a466f95fd40113bcdcca2ceb29b3b093921de45474da7df48874c630b1 Subject DN C=US, O=eMudhra Inc, CN=EM OV CS CA - G3C Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root CS CA - G3 zhangyoufu commented on Oct 20, 2026 ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105 https://platform.censys.io/certificates/42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493 Subject DN C=NL, O=eMudhra BV, CN=EM DV TLS CA - G3B Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3 49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f https://platform.censys.io/certificates/0164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19 Subject DN C=US, O=eMudhra Inc, CN=EM DV TLS CA - G3C Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3 e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41 https://platform.censys.io/certificates/e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838 Subject DN C=NL, O=eMudhra BV, CN=EM EV TLS CA - G3B Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3 5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0 https://platform.censys.io/certificates/432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3 Subject DN C=US, O=eMudhra Inc, CN=EM EV TLS CA - G3C Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3 43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b https://platform.censys.io/certificates/98b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b Subject DN C=NL, O=eMudhra BV, CN=EM OV TLS CA - G3B Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3 63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8 https://platform.censys.io/certificates/cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3f Subject DN C=US, O=eMudhra Inc, CN=EM OV TLS CA - G3C Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root TLS CA - G3 ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6 https://platform.censys.io/certificates/9e39de2881273acc225a149c72ba3e0f51424963669ab633ee1dc7df5db067b4 Subject DN C=NL, O=eMudhra BV, CN=EM OV CS CA - G3B Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root CS CA - G3 92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30 https://platform.censys.io/certificates/4b2460a466f95fd40113bcdcca2ceb29b3b093921de45474da7df48874c630b1 Subject DN C=US, O=eMudhra Inc, CN=EM OV CS CA - G3C Issuer DN C=IN, O=eMudhra Technologies Limited, CN=emSign Root CS CA - G3 x0wllaar commented on Oct 20, 2026 x0wllaar on Oct 20, 2026 More actions They've all been revoked due to cACompromise on Oct 18-19 as per CCADB, but there are no news and no reports of this anywhere... x0wllaar commented on Oct 20, 2026 They've all been revoked due to cACompromise on Oct 18-19 as per CCADB, but there are no news and no reports of this anywhere... Metadata Metadata Assignees Labels Type Projects Milestone Go1.28No due date Relationships Development Issue actions Open in GitHub Copilot app