The Go programming language will now reject certificate chains containing eight specific distrusted SPKIs. This change, implemented in Go 1.23, aligns with industry security standards by blocking certificates from these compromised or untrusted entities. The update ensures developers using Go for TLS connections are protected against known security vulnerabilities associated with these SPKIs.
The eight distrusted SPKIs include entities whose certificates have been flagged for security concerns. By automatically rejecting chains containing these SPKIs, Go enhances its security posture without requiring manual configuration from developers. This proactive approach helps prevent man-in-the-middle attacks and other certificate-based threats.
This security improvement reflects Go's commitment to maintaining robust cryptographic standards. Developers should verify their certificate chains don't rely on these distrusted SPKIs to avoid connection failures after the update.
Source: Hacker News · Summarized by HeadlinesBriefing