Glonce

Go blocks eight eMudhra intermediate certificates in crypto/x509

securityThe Glonce editorsHacker News🔥67Glonce rating67Impact55Novelty60Relevance70Surprise50Players40Credibility92
Go blocks eight eMudhra intermediate certificates in crypto/x509

The Go project has opened issue #82345, tracked as CVE-2026-111943, to block trust in a small set of intermediate certificates in the crypto/x509 package. The description says the certificates are being blocked "due to specific security concerns around their operation." From now on, Verify will filter out any certificate chain that contains one of these intermediates, so such chains are not returned to the caller. The Go team says it highly recommends upgrading to the release with the fix immediately. The issue was an URGENT track issue, originally tracked internally.

The issue lists the affected intermediates by SPKI hash, eight in all, each with a link to its Censys record. Their subjects are eMudhra entities: eMudhra BV (country NL) for the "G3B" certificates and eMudhra Inc (country US) for the "G3C" ones. There are G3B and G3C pairs for DV TLS, EV TLS and OV TLS (six certificates, issued under emSign Root TLS CA - G3) and for OV CS (two certificates, issued under emSign Root CS CA - G3). All are issued by eMudhra Technologies Limited (country IN). The first hash on the list is ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105 (EM DV TLS CA - G3B) and the last is 92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30 (EM OV CS CA - G3C).

The activity log shows the machinery for shipping the fix. A request to gopherbot to open backports produced backport issues #82348 for Go 1.26 and #82349 for Go 1.27. Three changes reference the issue, all titled "crypto/x509: distrust a handful of intermediates": CL 851047 for master, CL 851145 for release-branch.go1.26 and CL 851165 for release-branch.go1.27. On Oct 20, 2026 the issue title was changed from "security: fix CVE-2026-111943" to "crypto/x509: mitigation for security concerns with a specific Certificate Authority", and commits referencing the issue were added.

A later comment on the issue, from a user and not from the Go team, claims that all of the listed certificates "have all been revoked due to cACompromise on Oct 18-19 as per CCADB", and adds that there are no news and no reports of this anywhere. That claim is unconfirmed in the issue itself. The Go description gives no reason for the block beyond "specific security concerns."

Key facts

  • Go issue #82345 (CVE-2026-111943) blocks trust in a small set of intermediate certificates in crypto/x509; Verify will filter out chains that contain them.
  • The issue lists eight intermediates by SPKI hash; their subjects are eMudhra BV or eMudhra Inc, and they are issued under emSign Root TLS CA - G3 (six) and emSign Root CS CA - G3 (two).
  • Fixes titled "distrust a handful of intermediates" exist for master (CL 851047) and for release branches 1.26 (CL 851145) and 1.27 (CL 851165); backport issues are #82348 and #82349.
  • The Go team highly recommends upgrading to the release immediately; the issue was an URGENT track issue first tracked internally.
  • The description cites only "specific security concerns around their operation"; a later user comment claims the certificates were revoked for cACompromise on Oct 18-19.

Why it matters

Go's crypto/x509 is the verification path for TLS in a great many Go programs, so a change to which intermediates it trusts takes effect wherever those programs build chains. The Go team treated this as an URGENT track issue and recommends upgrading immediately. It also assigned a CVE, CVE-2026-111943, to what is a trust-list decision rather than a code bug. The issue says only that there are specific security concerns around the operation of these intermediates.

Who it affects

Anyone running Go code that verifies certificate chains with crypto/x509. The change applies to chains that contain any of the eight listed intermediates: Verify will filter them out instead of returning them to the caller. The listed certificates are eMudhra intermediates (EM DV TLS, EM EV TLS and EM OV TLS under emSign Root TLS CA - G3, and EM OV CS under emSign Root CS CA - G3), so services whose certificates chain through them are the ones that could see failures. The issue gives no affected-user count.

How to use it

Upgrade to the Go release that carries the fix. The Go team "highly recommend[s] immediately upgrading to this release." Fixes and backports exist for the 1.26 and 1.27 release branches (backport issues #82348 and #82349), plus master. No Go release version numbers are given for the fix, only the release branches. To check whether a chain is affected, compare the SPKI hashes of its intermediates with the eight hashes listed in the issue. No deadline for upgrading is stated.

How solid is it

The primary source is the official Go issue, with a CVE number and linked change lists, so the existence and scope of the mitigation are well established. The reason is not: the issue does not name the Certificate Authority or state the nature of the security concerns, and it gives no reason such as key compromise. The identification of eMudhra comes from the subject and issuer fields of the eight listed certificates. The cACompromise revocation claim comes from a later comment by a user, not from the Go team, and the commenter notes there are no news reports of it.

Risks and caveats

Chains that rely on any of the eight intermediates will no longer be returned by Verify, so connections that depended on them can start failing after the upgrade. The issue gives no impact assessment or exploitation evidence. The count of eight comes from the eight listed hashes, not from a sentence in the description. Treat the revocation claim as unverified until the Go team or the CA's disclosures confirm it.

“We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.”

— Go issue #82345, description