Let’s Encrypt Cuts Off Free SSL for Russian Government Websites

The Internet Security Research Group, which runs Let’s Encrypt, quietly slipped a new clause into its Subscriber Agreement. The updated rules explicitly forbid issuing free SSL certificates to individuals or organizations residing or registered in territories under comprehensive US sanctions.

Under these new rules, any entities subject to US personal sanctions, export controls, or simply controlled by sanctioned individuals are blacklisted. Since the non-profit certificate authority is legally based in California, it has no choice but to salute the US Department of Commerce and obey the local export control laws, even if its main mission is to encrypt the entire world for free.

To clear up the panic, the head of the parent organization clarified that this is not a total blockade of ordinary Russian or Iranian users. Regular citizens and private companies will still get their green locks in the address bar without paying a dime. This loophole is kept alive thanks to the Office of Foreign Assets Control (OFAC) exceptions, which protect basic human rights and free communication for regular people living under authoritarian regimes.

Essentially, the updated agreement simply documents the actual filtering system that has already been running behind the scenes for years. Russian government websites will have to rely on their own homegrown, self-signed certificates, which most modern browsers treat like a suspicious unmarked package left on a doorstep.

Watching Russian state portals scramble to explain to their citizens why their web browsers keep screaming about "untrusted connections" is pure digital comedy. In the end, the dreams of a completely sovereign, state-approved internet always seem to crash into the harsh reality of global web infrastructure.

Source: Hacker News