Post

Go's crypto/x509 VerifyOptions has no CRL or OCSP setting. With its own root pool, Go 1.27.2 still verified eMudhra intermediates that CCADB lists as revoked on October 18 and 19. Go 1.27.3 rejects them by public key instead.