Pull to refresh
Logo
Go blocks trust in eight eMudhra certificate intermediates

Go blocks trust in eight eMudhra certificate intermediates

Rule Changes

Urgent crypto/x509 fix removes trust in eMudhra intermediates

Yesterday: Test certificates reveal the issue

Overview

Updated 2 hours ago

Go will reject any TLS certificate chain that includes one of eight distrusted intermediate certificates, all issued by the Indian certificate authority eMudhra. The change, an urgent security fix tracked as CVE-2026-111943, ships in Go 1.26, 1.27, and the upcoming 1.28.

The distrust follows two Certificate Transparency log operators blocking eMudhra-issued certificates, a step that usually signals a suspected private key compromise. Go applications that connect to servers using these certificates will fail to establish TLS connections after upgrading.

Why it matters

Go-based applications will refuse TLS connections to servers using eMudhra's eight distrusted intermediates, breaking services until those sites reissue certificates.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

8
Distrusted SPKI hashes
Go will reject any chain containing these eight eMudhra intermediate keys.
16
eMudhra certificates affected
Certificates in CT logs issued by the blocked intermediates.
3
Go versions patched
Go 1.26, 1.27, and 1.28 include the fix.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

People Involved

Organizations Involved

Timeline

4 events Latest: Yesterday
Tap a bar to jump to that date
  1. Test certificates reveal the issue

    Latest Discovery

    Test certificates from eMudhra intermediates appear in CT logs, including 'we-have-a-problem.com' domains.

  2. Go blocks eight eMudhra intermediates

    Security

    Go security team announces it will reject chains with eight distrusted eMudhra SPKIs (CVE-2026-111943).

  3. Fix merged and backported

    Release

    Fix merged to Go master and backported to 1.26 and 1.27; go1.27.3 includes the patch.

  4. CT logs block eMudhra certificates

    Security

    Two CT log operators block eMudhra-issued certificates, signaling suspected key compromise.

Scenarios

1

Mozilla, Apple, and Google follow Go in distrusting eMudhra

Likely Resolves by Apr 19, 2027

Discussed by: Mozilla CA Certificate Policy group, CCADB

If the suspected private key compromise is confirmed, other trust stores will likely follow Go's lead. Mozilla's process for CA distrust involves public discussion and a vote by the Mozilla CA Certificate Policy group. Apple and Google typically act faster when a compromise is confirmed.

2

eMudhra reissues certificates and restores trust

Possible Resolves by Jan 19, 2027

Discussed by: eMudhra, affected customers

If the issue is contained to specific intermediates and eMudhra can demonstrate remediation, it may reissue certificates from unaffected intermediates. Affected customers would need to update their server configurations to restore TLS connections.

3

Investigation confirms private key compromise, full CA distrust

Uncertain Resolves by Apr 19, 2027

Discussed by: Security researchers, CT log operators

If the CT log blocking reflects a confirmed private key compromise, eMudhra's root CAs could face full distrust across the ecosystem. This would be the most severe outcome, similar to DigiNotar in 2011, and would force all eMudhra customers to migrate to a different CA.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

July-September 2011

DigiNotar compromise (2011)

Dutch certificate authority DigiNotar was compromised in 2011. Attackers issued fraudulent certificates for Google, Yahoo, Mozilla, and other major sites. The breach was discovered after a fraudulent Google certificate was found in the wild.

Then

All major browsers distrusted DigiNotar within weeks. The company went bankrupt.

Now

Established the playbook for CA compromise response: immediate distrust, forensic investigation, and CA shutdown.

Why this matters now

Shows what happens when a CA's private keys are compromised. The eMudhra situation may follow a similar path if the compromise is confirmed.

2017-2018

Symantec CA distrust (2017)

Google announced it would distrust Symantec's certificates after years of misissuance by Symantec and its subsidiaries. The distrust was phased in over 18 months, giving affected customers time to reissue.

Then

Symantec sold its certificate business to DigiCert.

Now

Established that even large CAs can face distrust for systemic misissuance.

Why this matters now

Shows the gradual process of CA distrust, in contrast to the rapid action Go took with eMudhra.

November-December 2022

TrustCor removal (2022)

Investigative reporting by The Record revealed that TrustCor's leadership had ties to a surveillance company. Mozilla and other trust stores removed TrustCor within weeks.

Then

TrustCor was removed from major trust stores.

Now

Established that CA trust requires not just technical security but also organizational integrity.

Why this matters now

Shows the trust store review process in action and how quickly distrust can spread across the ecosystem.

Sources

(5)