Go 1.27.3 and 1.26.10 distrust eight CA keys
Go 1.27.3 and 1.26.10 now reject certificate chains tied to eight blocked CA public keys after applications are rebuilt.
R/PROGRAMMING (TOP) — The supplied material describes the releases as an emergency response to security concerns but gives no explanation of the affected authorities or the underlying issue. The linked report is the relevant follow-up for Go maintainers.
The r/programming post links to a report about Go 1.27.3 and Go 1.26.10. Both versions reject certificate chains that rely on eight blocked CA public keys once an application has been rebuilt with either release.
The supplied material does not identify the keys or explain the security concerns behind the block. It presents the change as an emergency update.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.