𝗛𝗲𝗿𝗲'𝘀 𝘄𝗵𝗮𝘁 𝗖𝗩𝗘-𝟮𝟬𝟮𝟲-𝟭𝟭𝟭𝟵𝟰𝟯 𝗺𝗲𝗮𝗻𝘀 𝗳𝗼𝗿 𝘆𝗼𝘂𝗿 𝗚𝗼 𝘀𝗲𝗿𝘃𝗶𝗰𝗲𝘀

Go 1.27.3 and 1.26.10 shipped this week with a fix in 𝚌𝚛𝚢𝚙𝚝𝚘/𝚡𝟻𝟶𝟿. The changelog makes it sound small. It isn't, so here's the plain-English version.

𝗧𝗵𝗲 𝗽𝗿𝗼𝗯𝗹𝗲𝗺, 𝘀𝗶𝗺𝗽𝗹𝘆

When your Go code calls 𝚑𝚝𝚝𝚙.𝙶𝚎𝚝("𝚑𝚝𝚝𝚙𝚜://𝚊𝚙𝚒.𝚜𝚝𝚛𝚒𝚙𝚎.𝚌𝚘𝚖"), how does it know it's really talking to Stripe?

The server shows a certificate, like an ID card. Your program checks that the ID was stamped by an authority it trusts (a Certificate Authority, or CA).

Now imagine one of those authorities made its official stamps so badly that anyone could recreate them in seconds.

That's roughly what happened with eMudhra, an Indian CA. A flaw in their key generation produced 8 intermediate CA keys with almost no randomness. One key was literally the number 4. The others were small whole numbers under 256.…