Go to reject certificate chains containing eight distrusted public keys

The Go team has prepared a change for the go1.27 release branch that removes trust from a handful of intermediate certificate authorities. When verifying a chain, crypto/x509 will now discard it entirely if it contains even one "distrusted" public key.

How it works

The code gains a distrustedSPKIHashes map — a set of eight SHA-256 values computed over the SubjectPublicKeyInfo (SPKI) field of specific certificates. A helper, containsDistrustedSPKIHash, walks every certificate in a chain, hashes each SPKI, and checks it against that list.

The check is wired into three verification paths. In the cross-platform verify.go, chains with a banned key are marked for removal in the common filter. On macOS (root_darwin.go) and Windows (root_windows.go), which rely on system verification, matching snippets drop the offending chains; if none remain valid afterwards, a CertificateInvalidError with the NoValidChains reason is returned.

It is the hash of the public key, not of the whole certificate, that is compared. That means reissuing a certificate with the same key, or reusing the same key in a different intermediate, will not sidestep the ban.

Who is affected

The commit itself lists eight SPKI hashes. According to a commenter who cross-referenced them against the CA data published on CCADB, those eight keys correspond to sixteen certificates, all belonging to a single authority — eMudhra. The same person posted a matched-up list.

As a result, once the runtime is updated, Go applications will stop establishing TLS connections whose trust rests on these intermediates — regardless of what the operating system's own certificate store thinks of them.

Source: Lobsters