Go 将拒绝包含八个不受信任 SPKI 的证书链。

Go 将拒绝包含八个不受信任 SPKI 的证书链。
Go will reject certificate chains containing eight distrusted SPKIs

原始链接: https://github.com/golang/go/issues/82345

由于其运行相关的具体安全顾虑，我们正在阻止对一小部分中间证书的信任。Verify 现在将过滤掉包含这些中间证书的证书链，防止它们被返回给调用方。我们强烈建议立即升级到此版本。这是 CVE-2026-111943 和 Go issue https://go.dev/issue/82345。这是一个 URGENT track issue，最初在 http://b/575512169 跟踪。

一篇 Hacker News 帖子报告称，Go 将拒绝包含八个不受信任 SPKI 的证书链。该帖链接到一个 GitHub 讨论，获得 11 个点赞。评论指出证书无法由多个 CA 签名令人遗憾，提供 Mozilla Bugzilla 链接以供更多背景信息，并分享了一份列出 CCADB 数据中受影响证书的 gist。

We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.

Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.

We highly recommend immediately upgrading to this release.

This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.

This was an URGENT track issue originally tracked in http://b/575512169.

Go 将拒绝包含八个不受信任 SPKI 的证书链。 Go will reject certificate chains containing eight distrusted SPKIs

Go 将拒绝包含八个不受信任 SPKI 的证书链。
Go will reject certificate chains containing eight distrusted SPKIs