Unverified50% confidenceFactExact time
When using the Go standard library to initiate a TLS connection or validate a certificate chain, if the peer's certificate chain contains any of these eight SPKIs, validation will fail and return an error.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/20/2026
First Seen
Valid until: 1/18/2027
Sources
Related Entities
Related Claims
UnverifiedWhen validating a certificate chain, Go's crypto/x509 package computes the SPKI hash of each certificate in the chain and compares it against a built-in blacklist, terminating validation upon a match.76% similarUnverifiedRejecting specific SPKIs this time is a continuation of Go's proactive defense strategy, but being precise down to the public key level means that even if a CA as a whole remains trusted, its specific public keys can be individually marked as untrusted.64% similarUnverified现代TLS协议的安全性建立在X.509证书体系和公钥基础设施（PKI）之上，浏览器和操作系统内置了数百个受信任的根CA60% similarUnverifiedRecursive resolvers performing DNSSEC validation must add the new KSK to their trust anchor list in advance; otherwise, after the old key is retired, they will be unable to verify signatures and will return SERVFAIL errors.60% similarUnverifiedSPKI is a standard field in X.509 certificates that follows the ASN.1 SubjectPublicKeyInfo structure and contains the public key algorithm identifier and the public key itself.59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1073186API
curl https://kongchang.com/api/v1/knowledge/claims/1073186MCP
get_claim(id=1073186)