Risky Bulletin: Sanctions force CAs to revoke TLS certs in Iran, Russia
US Treasury sanctions since May have forced certificate authorities to revoke TLS certificates for Russian and Iranian government, bank, and media sites.
May 2026 US Treasury sanctions prohibit CAs from issuing certificates to government entities in sanctioned countries, causing mass revocations and outages in Russia and Iran. GlobalSign mass-revoked Russian customer certificates in June, and Russian banks switched to a state-run CA in August. Iranian banks moved to Chinese providers in September after Western refusals, while consumers on Western browsers often cannot trust the replacement CAs. Let's Encrypt says it may still issue to non-governmental people and organizations under exemptions.
45