# RUSSIA: Potential Sanctions Compliance Issue: Certificate issued to SDN-controlled domain (rt-english.com) **URL:** \ **Category:** Issuance Policy\ **Created:** [October 22, 2026, 7:54am UTC](https://community.letsencrypt.org/t/russia-potential-sanctions-compliance-issue-certificate-issued-to-sdn-controlled-domain-rt-english-com/252320 "2026-10-22T07:54:35Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![davidkent](https://avatars.discourse-cdn.com/v4/letter/d/cab0a1/32.png) [@davidkent](https://community.letsencrypt.org/u/davidkent)\ **Post date:** [October 22, 2026, 7:54am UTC](https://community.letsencrypt.org/t/russia-potential-sanctions-compliance-issue-certificate-issued-to-sdn-controlled-domain-rt-english-com/252320/1 "2026-10-22T07:54:35Z")
Hello Let's Encrypt Team, I am writing to flag a potential compliance issue regarding an active SSL certificate issued to a domain that appears to be operated by a U.S. government-sanctioned entity. - **Target Domain:** `rt-english.com` - **Certificate Authority / Type:** Let's Encrypt (E1 / Y1 / R10) - **Underlying Entity:** RT (formerly Russia Today) / Federal State Unitary Enterprise International Information Agency Rossiya Segodnya. **Applicable Legal and Policy Frameworks:** 1. **OFAC SDN List Designation:** The parent organization behind RT ( **Rossiya Segodnya** , Tax ID: 7704853840) is an explicitly blacklisted entity on the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) SDN List under **Executive Order 14024**. [[1](https://sanctionssearch.ofac.treas.gov/Details.aspx?id=50690), [2](https://home.treasury.gov/news/press-releases/jy2559)] 2. **CA/Browser Forum Requirements:** As of May 2026, the global **CA/Browser Forum Baseline Requirements** mandate that certificate authorities must actively check against and enforce sanctions restrictions. [[1](https://www1.ru/en/news/2026/06/14/lets-encrypt-ogranicit-vydacu-ssl-sertifikatov-saitov-dlia-rossiiskix-gosucrezdenii.html)] 3. **Let's Encrypt Subscriber Agreement (v1.7):** Section 4 of the updated Subscriber Agreement binds users to a warranty that they are not a restricted party or operating on behalf of an entity target of U.S. sanctions. **Context on Evasion:** Commercial certificate authorities (such as [GlobalSign](https://www.globalsign.com/) and DigiCert) have previously revoked certificates for RT's primary web properties. The domain `rt-english.com` appears to be a new domain spun up to circumvent domain blocks and infrastructure restrictions. [[1](https://community.ipinfo.io/t/globalsign-is-revoking-ssl-certificates-for-russian-websites-here-is-what-the-data-shows/7381), [2](https://www.feistyduck.com/newsletter/issue_87_russia_creates_certificate_authority_in_response_to_sanctions), [3](https://blackbird.ai/blog/how-russian-state-media-evade-sanctions-using-proxy-domains/)] They mentioned on their new article this is exactly what they have done: [Public address — RT](https://rt-english.com/trends/public-address-democracy-darkness/) Because Let's Encrypt's issuance is automated, this domain likely bypassed the automated SDN filters due to the registration using a new domain variant. Could the compliance team please review this endpoint to determine if it violates Let's Encrypt's U.S. legal obligations? [[1](https://community.letsencrypt.org/t/russia-other-any-restricitons/226348)] Thank you for your time and diligence. * * * ---
**Author:** ![davidkent](https://avatars.discourse-cdn.com/v4/letter/d/cab0a1/32.png) [@davidkent](https://community.letsencrypt.org/u/davidkent)\ **Post date:** [October 22, 2026, 8:07am UTC](https://community.letsencrypt.org/t/russia-potential-sanctions-compliance-issue-certificate-issued-to-sdn-controlled-domain-rt-english-com/252320/2 "2026-10-22T08:07:59Z")
@josh may be of interest. I've seen [max.ru](http://max.ru) was blocked because it was sanctioned entity. This should be too. > [@Why issue certificate for max.ru forbidden by policy?](https://community.letsencrypt.org/t/why-issue-certificate-for-max-ru-forbidden-by-policy/248143): > > T… ---
**Author:** ![MaxHearnden](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maxhearnden/32/87555_2.png) [@MaxHearnden](https://community.letsencrypt.org/u/MaxHearnden)\ **Post date:** [October 22, 2026, 10:51am UTC](https://community.letsencrypt.org/t/russia-potential-sanctions-compliance-issue-certificate-issued-to-sdn-controlled-domain-rt-english-com/252320/3 "2026-10-22T10:51:13Z")
While I'm sure that Let's Encrypt staff read this forum, the appropriate place to send these reports is [cert-prob-reports@letsencrypt.org](mailto:cert-prob-reports@letsencrypt.org). They will then have to ask OFAC for permission to cease issuing certificates and revoke current certificates issued by them so the process might take some time. ---
**Author:** ![davidkent](https://avatars.discourse-cdn.com/v4/letter/d/cab0a1/32.png) [@davidkent](https://community.letsencrypt.org/u/davidkent)\ **Post date:** [October 22, 2026, 10:54am UTC](https://community.letsencrypt.org/t/russia-potential-sanctions-compliance-issue-certificate-issued-to-sdn-controlled-domain-rt-english-com/252320/4 "2026-10-22T10:54:24Z")
Yes I did already. I thought I'd post here and send the email. So quicker action and if I was wrong, I could be corrected by the community as to why they are allowed the SSL. From what I understand, I'm correct that they are not allowed the SSL from Let's Encrypt. ---
**Author:** ![MaxHearnden](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maxhearnden/32/87555_2.png) [@MaxHearnden](https://community.letsencrypt.org/u/MaxHearnden)\ **Post date:** [October 22, 2026, 3:42pm UTC](https://community.letsencrypt.org/t/russia-potential-sanctions-compliance-issue-certificate-issued-to-sdn-controlled-domain-rt-english-com/252320/5 "2026-10-22T15:42:11Z")
> [@davidkent](#): > > From what I understand, I'm correct that they are not allowed the SSL from Let's Encrypt. It's more that due to US legislation, Let's Encrypt are not allowed to perform any transactions with sanctioned entities without permission from OFAC. Unfortunately with how the legislation is written, terminating service and revoking certificates are also transactions requiring permission from OFAC. ---
**Author:** ![davidkent](https://avatars.discourse-cdn.com/v4/letter/d/cab0a1/32.png) [@davidkent](https://community.letsencrypt.org/u/davidkent)\ **Post date:** [October 23, 2026, 8:54am UTC](https://community.letsencrypt.org/t/russia-potential-sanctions-compliance-issue-certificate-issued-to-sdn-controlled-domain-rt-english-com/252320/6 "2026-10-23T08:54:37Z")
@MaxHearnden are you saying it could take Let's Encrypt a long time to even revoke the certificate? If so that's ridiculous because Russia Today could just spin up another domain with let's Encrypt. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [October 23, 2026, 9:11am UTC](https://community.letsencrypt.org/t/russia-potential-sanctions-compliance-issue-certificate-issued-to-sdn-controlled-domain-rt-english-com/252320/7 "2026-10-23T09:11:44Z")
> [@davidkent](#): > > it could take Let's Encrypt a long time to even revoke the certificate? They'll prolly just let it expire. I think there was a write-up from a LE staff member about how this legally works (in just a few words), but I can't seem to find it unfortunately. ---
**Author:** ![davidkent](https://avatars.discourse-cdn.com/v4/letter/d/cab0a1/32.png) [@davidkent](https://community.letsencrypt.org/u/davidkent)\ **Post date:** [October 23, 2026, 9:15am UTC](https://community.letsencrypt.org/t/russia-potential-sanctions-compliance-issue-certificate-issued-to-sdn-controlled-domain-rt-english-com/252320/8 "2026-10-23T09:15:49Z")
I'm surprised I haven't received a response to my email at [cert-prob-reports@letsencrypt.org](mailto:cert-prob-reports@letsencrypt.org) yet. I got an automated response saying a ticket was created. I'm equally surprised It could take a long time for any kind of action to happen. **It would be nice to hear an official response to this. As RT is sanctioned after all.** ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [October 23, 2026, 9:22am UTC](https://community.letsencrypt.org/t/russia-potential-sanctions-compliance-issue-certificate-issued-to-sdn-controlled-domain-rt-english-com/252320/9 "2026-10-23T09:22:41Z")
> [@davidkent](#): > > I'm surprised I haven't received a response to my email at [cert-prob-reports@letsencrypt.org](mailto:cert-prob-reports@letsencrypt.org) yet. Most likely b/c it's not a violation of e.g. the baseline requirements, which _could_ mandate actions within 24 hours and such things.. The LE staff is very small and I can imagine that if this isn't a breach of BR, this gets categorised as something of a lower importance.. No need to phone a supervisor in the middle of the night kind of urgency. When legal stuff is involved, it gets complicated fairly quickly 🤣 But I'm just speculating here 🙂 ---
**Author:** ![MaxHearnden](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/maxhearnden/32/87555_2.png) [@MaxHearnden](https://community.letsencrypt.org/u/MaxHearnden)\ **Post date:** [October 23, 2026, 11:25am UTC](https://community.letsencrypt.org/t/russia-potential-sanctions-compliance-issue-certificate-issued-to-sdn-controlled-domain-rt-english-com/252320/10 "2026-10-23T11:25:06Z")
@Osiris Here it is. > [@Report terrorist group who has letsencrypt certificate](https://community.letsencrypt.org/t/report-terrorist-group-who-has-letsencrypt-certificate/245185/12): > > T… ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [October 23, 2026, 12:18pm UTC](https://community.letsencrypt.org/t/russia-potential-sanctions-compliance-issue-certificate-issued-to-sdn-controlled-domain-rt-english-com/252320/11 "2026-10-23T12:18:06Z")
Thnx! That is indeed the post I was looking for that explains this counterintuitive aspect regarding revoking certs for sanctioned entities.