Go security releases block eight certificate authority keys

Go 1.27.3 and Go 1.26.10, released October 20, reject certificate chains passing through eight intermediate certificate authority keys, The Hacker News reports. The Go team recommends immediate upgrades, citing security concerns about an unnamed certificate authority's operation. The filter checks public keys, so it also catches copies signed by different roots. It applies to Go's verifier and its macOS and Windows operating-system verification paths, with no setting to disable it, including for programs supplying their own trusted roots. Programs retain the old behavior until rebuilt. Services using certificates that chain through the blocked keys need certificates from a different intermediate to remain accessible to rebuilt Go clients.