Go 1.27.3 and 1.26.10 introduce an urgent certificate verification update that rejects chains passing through eight specific intermediate CA keys, preventing rebuilt applications from connecting to affected services.
The Go team said the keys belonged to an organization that issues digital certificates, without naming it. It explained that it was blocking them due to “specific concerns about the security of its operation,” but did not say exactly what happened. It listed the fix in the most serious security issue category and recommended an immediate upgrade.
Go's change only lists the codes that identify the eight keys. One commenter matched the codes to eMudhra certificates, which act as an intermediary in confirming the trustworthiness of other certificates. According to that match, six are certificates for secure connections to websites and two are certificates used to sign programs. The Hacker News said it did not independently verify the codes with the certificates.
On October 17, 2026, Mozilla added six certificates issued by emSign Root TLS CA – G3 to Firefox's list of blocked certificates. Mozilla did not name the certificates, and neither Mozilla nor Go explained what prompted their actions. It has not been confirmed whether Google, Apple, or Microsoft took similar action.
READ ALSO
Plex users urged to immediately update due to serious security risk
The blocking applies to Go's certificate checking, even when a program delegates checking to Windows or macOS. Go checks the digital key of the certificate, so it also blocks other certificates that use the same key, even if they are approved by a different authority. There is no setting to disable the filter. From the way the change was made, it seems that it also applies when a program sets its own trusted certificates, but Go has not said whether this is appropriate.
Programs that have already been built retain their previous behavior until they are rebuilt with a new version of Go. Bluesky's indigo was rebuilt with the new versions on October 20, 2026. Websites and services that rely on the eight keys will need certificates issued by a different authority so that rebuilt programs can connect to them.
Go 1.25 and older versions are no longer supported and are not receiving fixes. According to the post, there is no temporary workaround for the block.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)