RUSSIA: Potential Sanctions Compliance Issue: Certificate issued to SDN-controlled domain (rt-english.com)

Issuance Policy
1

Hello Let's Encrypt Team,

I am writing to flag a potential compliance issue regarding an active SSL certificate issued to a domain that appears to be operated by a U.S. government-sanctioned entity.

  • Target Domain: rt-english.com
  • Certificate Authority / Type: Let's Encrypt (E1 / Y1 / R10)
  • Underlying Entity: RT (formerly Russia Today) / Federal State Unitary Enterprise International Information Agency Rossiya Segodnya.

Applicable Legal and Policy Frameworks:

  1. OFAC SDN List Designation: The parent organization behind RT (Rossiya Segodnya, Tax ID: 7704853840) is an explicitly blacklisted entity on the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) SDN List under Executive Order 14024. [1, 2]

  2. CA/Browser Forum Requirements: As of May 2026, the global CA/Browser Forum Baseline Requirements mandate that certificate authorities must actively check against and enforce sanctions restrictions. [1]

  3. Let's Encrypt Subscriber Agreement (v1.7): Section 4 of the updated Subscriber Agreement binds users to a warranty that they are not a restricted party or operating on behalf of an entity target of U.S. sanctions.

    [1, 2]

Context on Evasion:
Commercial certificate authorities (such as GlobalSign and DigiCert) have previously revoked certificates for RT's primary web properties. The domain rt-english.com appears to be a new domain spun up to circumvent domain blocks and infrastructure restrictions. [1, 2, 3]

They mentioned on their new article this is exactly what they have done: Public address — RT

Because Let's Encrypt's issuance is automated, this domain likely bypassed the automated SDN filters due to the registration using a new domain variant.

Could the compliance team please review this endpoint to determine if it violates Let's Encrypt's U.S. legal obligations? [1]

Thank you for your time and diligence.

2

@josh may be of interest. I've seen max.ru was blocked because it was sanctioned entity. This should be too.

3

While I'm sure that Let's Encrypt staff read this forum, the appropriate place to send these reports is cert-prob-reports@letsencrypt.org. They will then have to ask OFAC for permission to cease issuing certificates and revoke current certificates issued by them so the process might take some time.

4

Yes I did already.

I thought I'd post here and send the email. So quicker action and if I was wrong, I could be corrected by the community as to why they are allowed the SSL. From what I understand, I'm correct that they are not allowed the SSL from Let's Encrypt.

5

It's more that due to US legislation, Let's Encrypt are not allowed to perform any transactions with sanctioned entities without permission from OFAC.

Unfortunately with how the legislation is written, terminating service and revoking certificates are also transactions requiring permission from OFAC.

6

@MaxHearnden are you saying it could take Let's Encrypt a long time to even revoke the certificate? If so that's ridiculous because Russia Today could just spin up another domain with let's Encrypt.

7

They'll prolly just let it expire.

I think there was a write-up from a LE staff member about how this legally works (in just a few words), but I can't seem to find it unfortunately.

8

I'm surprised I haven't received a response to my email at cert-prob-reports@letsencrypt.org yet. I got an automated response saying a ticket was created.

I'm equally surprised It could take a long time for any kind of action to happen.

It would be nice to hear an official response to this. As RT is sanctioned after all.

9

Most likely b/c it's not a violation of e.g. the baseline requirements, which could mandate actions within 24 hours and such things.. The LE staff is very small and I can imagine that if this isn't a breach of BR, this gets categorised as something of a lower importance.. No need to phone a supervisor in the middle of the night kind of urgency. When legal stuff is involved, it gets complicated fairly quickly :rofl: But I'm just speculating here :slight_smile:

10

@Osiris Here it is.

11

Thnx! That is indeed the post I was looking for that explains this counterintuitive aspect regarding revoking certs for sanctioned entities.