Unverified50% confidenceFactExact time
When validating a certificate chain, Go's crypto/x509 package computes the SPKI hash of each certificate in the chain and compares it against a built-in blacklist, terminating validation upon a match.
1
Sources
50%
Confidence
Long-term
Relevance
10/20/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe crypto/x509 package in the Go standard library has a built-in trust policy for root and intermediate certificates that is independent of the root certificate stores maintained by operating systems or browsers.77% similarUnverifiedWhen using the Go standard library to initiate a TLS connection or validate a certificate chain, if the peer's certificate chain contains any of these eight SPKIs, validation will fail and return an error.76% similarUnverifiedThe Go standard library's crypto/hmac, crypto/sha256, and encoding/base64 provide built-in cryptographic and encoding capabilities required to implement JWT.68% similarUnverifiedRejecting specific SPKIs this time is a continuation of Go's proactive defense strategy, but being precise down to the public key level means that even if a CA as a whole remains trusted, its specific public keys can be individually marked as untrusted.67% similarUnverifiedSPKI is a standard field in X.509 certificates that follows the ASN.1 SubjectPublicKeyInfo structure and contains the public key algorithm identifier and the public key itself.67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1073184API
curl https://kongchang.com/api/v1/knowledge/claims/1073184MCP
get_claim(id=1073184)