crypto/x509: mitigation for security concerns with a specific Certificate Authority

We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.

Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.

We highly recommend immediately upgrading to this release.

This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.

This was an URGENT track issue originally tracked in http://b/575512169.

@gopherbot Please open backports for this issue.

Backport issue(s) opened: #82348 (for 1.26), #82349 (for 1.27).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[release-branch.go1.26] crypto/x509: distrust a handful of intermediates

[release-branch.go1.27] crypto/x509: distrust a handful of intermediates

Change https://go.dev/cl/851165 mentions this issue: [release-branch.go1.27] crypto/x509: distrust a handful of intermediates

Change https://go.dev/cl/851145 mentions this issue: [release-branch.go1.26] crypto/x509: distrust a handful of intermediates

Change https://go.dev/cl/851047 mentions this issue: crypto/x509: distrust a handful of intermediates

crypto/x509: distrust a handful of intermediates

external/go: Update to go1.27.3

Go will reject certificate chains containing eight distrusted SPKIs