Go now refuses any certificate chain built on eight distrusted intermediates

Go will reject certificate chains containing eight distrusted SPKIs

Go's crypto/x509 package has been patched to block trust in a small set of intermediate certificates over security concerns about how they were operated. Verify now filters out any chain containing these intermediates, so they are never returned to the caller. Tracked as CVE-2026-111943 and issue #82345, the fix was a release-blocker landing in Go 1.28, with backports opened for 1.26 and 1.27. The team urges users to upgrade immediately.