Go to Reject Certificate Chains with Eight Distrusted SPKIs

Summary: The Go programming language will now reject certificate chains that contain eight distrusted Subject Public Key Info (SPKI) entries. This change primarily affects 16 certificates, all originating from eMudhra, which will now be considered invalid by Go applications.

The Go runtime has decided to reject specific certificate chains. This targets certificates containing eight distrusted Subject Public Key Info (SPKI) entries. SPKI is a unique identifier for the public key within a certificate, and such rejections typically target Certificate Authorities (CAs) that have lost trust due to security vulnerabilities or misconfigurations.

Go’s TLS (Transport Layer Security) implementation will check these SPKIs during the certificate chain validation process. When a chain containing any of the marked distrusted SPKIs is encountered, the Go application will reject the connection and return an error. This typically operates through the validation logic within the crypto/x509 package.

Go applications in live systems might experience issues when communicating with external services or internal components that use such certificates. Infrastructures relying on eMudhra-issued certificates, in particular, could face outages as Go applications will be unable to access these services. This may necessitate certificate renewals or migration to alternative CAs.

It is crucial for engineers to review all certificate chains used by their Go applications and check if they contain any of the affected SPKIs. Such changes often accompany security updates and are critical for enhancing system security.

🔗 Source: Lobsters
💬 Community Discussion: Inspect
📡 Authoritative feeds & live tracking: Radar