curl: (60) SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.
Great. The technology has progressed enough to kill the existing technologies. It's like the fish in a pool creating a shark that eats away all the fish while the fish proudly announce that their great creation (shark) as the frontier progress for their fish race.
In other words, that software bundled the compromised certs into the binary, so upgrading it is the only way to remove them.
This is about Go proactively blocking intermediates. Which shouldn't strictly be necessary as long as your OS has removed or distrusted the CAs (on my laptop, macOS has done that, although it seems like it did so in a way not all tools have access to; for example, rustls-platform-verifier respects it, but rustls-webpki still loads the bad CAs from the system trust store).
Im guessing this only affects Go? But I am guessing that from the nist page as none of the headlines mention it at all.
Gentoo Linux users are adviced to update the package "app-misc/ca-certificates" to version "20260816.3.125" or higher!:
To check via "curl": They should return: ---* GLSA 202610-01: https://security.gentoo.org/glsa/202610-01
* https://emudhra.we-have-a-problem.com/
This is news for NIST but old news generally speaking, being the eMudhra debacle. Or am I missing something?
This seems to be about ‘go’ proactively blocking emudhra certs even though the system trust store is out of date? https://pkg.go.dev/vuln/GO-2026-6809
It's a bit surprising that this took ~1.5days to end up on HN.
It didn't
https://news.ycombinator.com/item?id=50166579
It was here yesterday, this is just another good opportunity to farm some points.
It's down for me, are they on PHP? :D
Try this: https://www.cve.org/CVERecord?id=CVE-2026-111943
I'd assume hugged to death
Up for me, but slow to load.
Great. The technology has progressed enough to kill the existing technologies. It's like the fish in a pool creating a shark that eats away all the fish while the fish proudly announce that their great creation (shark) as the frontier progress for their fish race.
Here a CA derived a secret key from the number 4.
If you think "that's weird to see such a small number in key generation" than you're one step ahead of whoever generated that key.
Unfortunately, unlike with RSA, small primes are not apparent in elliptic cryptography.
The eMudhra CA compromises had nothing to do with LLMs? But I love the vibes.
https://emudhra.we-have-a-problem.com/
TL;DR:
The very urgent uv/certifi/etc releases (and yet-to-be-done bun release) are about removing the compromised CAs as described here:
https://emudhra.we-have-a-problem.com/
In other words, that software bundled the compromised certs into the binary, so upgrading it is the only way to remove them.
This is about Go proactively blocking intermediates. Which shouldn't strictly be necessary as long as your OS has removed or distrusted the CAs (on my laptop, macOS has done that, although it seems like it did so in a way not all tools have access to; for example, rustls-platform-verifier respects it, but rustls-webpki still loads the bad CAs from the system trust store).
edit: forgot I can't use code blocks on HN
I wonder if they made this change with an assumption that the root CAs wouldn't be distrusted later same day, too.
> edit: forgot I can't use code blocks on HN
Cock-up or conspiracy?