Go rebuilds can strand services behind blocked CA keys
Go released versions 1.27.3 and 1.26.10 on October 20, blocking eight certificate authority (CA) public keys over security concerns it has not disclosed.
After an application is rebuilt with either version, Go checks the public keys in each certificate chain and rejects any chain containing a blocked key—not just a particular certificate. That also catches copies of the same key signed by a different root, so Go clients can lose connections to services until their certificates use a different chain.
Go has not named the authority. The Hacker News reports that a commenter matched the key hashes to eMudhra/emSign intermediates, but says it has not independently verified the match. Mozilla added six intermediates under an emSign root to Firefox’s block list on October 17, without naming the certificates. If the match is right, organizations using those intermediates may face different trust decisions across clients; reporting has not established whether other browser vendors have acted.