Go Blocks Eight Certificate Authority Keys Over Undisclosed Security Concerns

The Go programming language has issued emergency updates, versions 1.27.3 and 1.26.10, to block eight intermediate certificate authority (CA) keys. This critical action, detailed in an October 20th release, prevents Go programs from establishing connections with websites and services that rely on certificates issued under these specific keys. The Go team has cited "specific security concerns around their operation" as the reason for this drastic measure, though the affected CA has not been publicly named.

The update was fast-tracked through Go's URGENT track, a designation reserved for the most severe issues, underscoring the perceived immediate threat. Developers are strongly advised to upgrade to the latest versions to ensure continued connectivity and security. The change specifically targets the SHA-256 hashes of eight keys, effectively disabling their use in certificate verification processes within Go applications.

This move by Go follows a similar action by Mozilla on October 17th, which added six intermediate certificates issued by eMudhra's emSign Root TLS CA - G3 to Firefox's OneCRL blocklist. The underlying reasons for both Go's and Mozilla's actions remain undisclosed, with the relevant bug reports closed to the public. It is currently unknown if other major browser vendors like Chrome, Apple, or Microsoft have taken comparable steps.

Analysis of the blocked key hashes by a community member suggests a strong link to eMudhra, an Indian certificate authority. Six of the blocked keys appear to be TLS intermediates (Domain Validated, Organization Validated, and Extended Validation) issued under the emSign Root TLS CA - G3, while two are code-signing intermediates under the emSign Root CS CA - G3. While The Hacker News has not independently verified these hashes, the correlation with Mozilla's actions is notable.

The implemented filter operates during certificate chain verification in Go programs. It hashes the public key of each certificate, ensuring that even cross-signed copies of the affected keys are caught. This filter is integrated into Go's native verifier and also affects certificate verification handled by the operating systems on macOS and Windows. A failed verification will result in an "x509: no valid chains built" error.

Notably, the filter is permanent and cannot be disabled within the Go code. It also applies even when a program uses its own set of trusted roots, meaning private deployments that might intentionally trust one of the blocked keys will also fail. Go's verifier does not perform revocation checking and does not utilize browser-based block lists, making this direct key blocking a blunt but effective measure.

For affected services and websites, the only solution is to obtain new certificates issued by a different, trusted intermediate CA. Go versions older than 1.25 are out of support and will not receive these security fixes, necessitating an upgrade for all users. The lack of public information from eMudhra or Go regarding the specific security concerns leaves the broader implications and the exact nature of the operational issues surrounding these keys unclear.