Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns

Key Points:

• Go versions 1.27.3 and 1.26.10, released on October 20, block certificate chains passing through eight specific intermediate certificate authority keys due to undisclosed security concerns related to one unnamed certificate authority.
• This change causes programs built with these Go versions to reject connections to sites using certificates issued under these keys, affecting TLS and code-signing intermediates linked to eMudhra's emSign Root TLS CA - G3.
• Mozilla similarly blocked six intermediate certificates from eMudhra on October 17 by adding them to its OneCRL revocation list, though details behind these actions remain undisclosed and no information is available about similar measures by other major vendors.
• The Go verifier applies this block universally without a disable option, including when custom trusted roots are used, and does not perform traditional revocation checks, meaning affected sites must replace their certificates to restore compatibility with updated Go clients.
• eMudhra, an Indian certificate authority, has not publicly commented on these developments, and older unsupported Go versions remain vulnerable, leaving users no workaround other than upgrading to the latest Go releases.