{"id":404,"date":"2025-07-29T09:53:35","date_gmt":"2025-07-29T16:53:35","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/go\/?p=404"},"modified":"2025-07-29T09:53:35","modified_gmt":"2025-07-29T16:53:35","slug":"microsoft-go-defaults-to-system-crypto","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/go\/microsoft-go-defaults-to-system-crypto\/","title":{"rendered":"Microsoft build of Go 1.25 crypto backend changes"},"content":{"rendered":"

Starting in Go 1.25<\/strong>, the Microsoft build of Go<\/a> will default to using system-provided cryptography<\/strong>: OpenSSL on Linux and CNG on Windows.\nThe systemcrypto<\/code> GOEXPERIMENT will be enabled by default and picks the supported backend for the target platform.<\/p>\n

This change aligns the Microsoft build of Go with Microsoft’s internal security and compliance policies, while keeping opt-out paths available for use cases that require it.<\/p>\n

What’s changing?<\/h2>\n

Prior to Go 1.25, developers can opt into using system-provided cryptography by setting the GOEXPERIMENT<\/code> environment variable to systemcrypto<\/code> before building their program.<\/p>\n

Starting with Go 1.25, the Microsoft toolchain enables systemcrypto<\/code> by default. Developers can opt out by setting the GOEXPERIMENT<\/code> environment variable to nosystemcrypto<\/code>.<\/p>\n

For more details on FIPS-140 compliance and how systemcrypto<\/code> interacts with FIPS mode, see the Microsoft build of Go FIPS Documentation<\/a>.<\/p>\n

Why this change?<\/h2>\n

Microsoft’s internal security and compliance policies require the use of system-provided cryptography libraries. By defaulting to enable systemcrypto<\/code>, the Microsoft build of Go now builds programs that meet this requirement automatically, without additional configuration by developers.<\/p>\n

While systemcrypto<\/code> can help enable FIPS-140 compliance in some environments, FIPS-140 is not the primary motivator of this change. Using a system-provided cryptographic library is part of a broader Microsoft internal cryptography policy, and most Go programs at Microsoft do not require FIPS mode. However, we expect that some developers who do need FIPS-140 compliance will find it easier after this change.<\/p>\n

Will this break my builds?<\/h2>\n

There are a few scenarios where you may need to take action:<\/p>\n