Go will reject certificate chains containing eight distrusted SPKIs

mendym

This seems to be the list of certs https://gist.github.com/mendymm/ff7a9fd00339260b4d2dbdcb0f48... data from https://www.ccadb.org/resources

ericbarrett

A bit more info (and some discussion linked from these Bugzilla reports): https://bugzilla.mozilla.org/show_bug.cgi?id=2083709 https://bugzilla.mozilla.org/show_bug.cgi?id=2018979

wnoise

It is a shame that you cannot have a cert signed by multiple CAs. (The format seems like it would allow it, but nothing supports it, and in practice CAs demand the ability to actually modify some fields, and then sign that.)

jeffbee

It's interesting that this sort of policy is baked into a language platform.

accountrequired

"Sir, this is a Wendy's" moment where my compiler thought it was a root certificate authority