On October 20, the Go programming language team released updates to versions 1.27.3 and 1.26.10, which reject certificate chains linked to eight specific intermediate certificate authority (CA) keys. This move impacts any programs built on these Go releases, as they will now refuse to connect to sites and services with certificates from these intermediates.
Background on the Certificate Authority Block
The Go team revealed that the blocked keys are associated with a single, unnamed CA, highlighting security concerns related to their operations. This update was released through Go’s URGENT track, emphasizing its critical nature. Users are strongly advised to upgrade immediately to maintain security and functionality.
Just days before, on October 17, Mozilla had similarly added six intermediate certificates from eMudhra’s emSign Root TLS CA – G3 to its OneCRL list, effectively blocking them in Firefox. The specific reasons behind these actions by Mozilla and Go remain undisclosed, and it is unclear if other major browsers have taken similar measures.
Technical Details of the Update
The Go update includes a list of SHA-256 hashes for the eight affected keys. A user identified these as belonging to eMudhra intermediates by matching the hashes with certificate records. The affected certificates include various types of TLS and code-signing intermediates issued under emSign Root TLS CA – G3 and emSign Root CS CA – G3.
Go’s filter mechanism processes every certificate chain verification, targeting the public keys rather than the certificates themselves. Consequently, even certificates cross-signed by different roots will be blocked. This filter is applied across Go’s verifier and operating system verification pathways, with no option to disable it, even in custom trusted root deployments.
Implications and Industry Response
Notably, Go’s verifier lacks revocation checking capabilities and does not integrate with browser block lists such as Chrome’s CRLSets. The blocking of a key necessitates an update in Go’s release, requiring programs to be rebuilt to adopt the new behavior. As of October 20, projects like Bluesky’s indigo had already been rebuilt on the new releases.
The underlying issues at the certificate authority remain undisclosed, with Go’s announcement providing only minimal details about the security concerns. This release came without any prior announcement, unlike Go’s security updates earlier in October. The Go team has not clarified which specific issues or exploitations prompted this urgent action.
eMudhra, an Indian CA issuing certificates under the emSign brand, has its roots included in major browser root stores. A recent public discussion concluded without objections to their request to add new roots, including emSign Root TLS CA – G3. Despite this, there is no official statement from eMudhra regarding the current situation.
Future Outlook and Recommendations
For those impacted by this update, obtaining certificates from different intermediates is necessary to ensure uninterrupted service. Go 1.25 and older versions remain unsupported, leaving the latest releases as the only secure option. No workaround exists for the current block, underscoring the importance of immediate compliance with the update.
