Russian domains not blocked anymore?

[johnygemityg]

Hi,

I saw today a russian website with valid LE certificate. Issued after restrictions have been applied.

See. https://cs.rin.ru/

I tried generate one for myself and I was sucesfull as well. What does it mean?

[orangepizza]

I don't think LE ban any domain unless they legally required to

[danb35]

LE has never had a ban on Russian domains generally, and there's been a great deal of prior discussion of that subject.

[johnygemityg]

There was a time when LE was refusing issuing a certificate for .ru domains. It was around September. That's when LE refused my attempt.

Can you send a link to the discusion please?

[griffin]

There have been many such discussions. You can use the search function at the top to find them.

[danb35]

@johnygemityg

There was a time when LE was refusing issuing a certificate for .ru domains.

No, there never was any such time. There were a number of folks who requested or demanded, with varying degrees of good faith in the discussion, that this be the case, but LE never acted on those requests. If you'd like to read those discussions, the Search button is your friend.

[Nekit]

If the reason for refusal stated “The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy” then indeed Let's Encrypt itself refused to issue the certificate. If the error message was different, then LE most probably had nothing to do with the refusal.

[johnygemityg]

Allright.

It was probably my fault. At that time I was probably rejected by ZeroSSL and when I tried with LE I attributed the failure to restrictions as well.

Thank you guys.

[catharsis]

Digicert and Sectigo both have .RU blocked. I think ZeroSSL uses one of them?

[griffin]

To my knowledge, ZeroSSL is an independent CA.

[mcpherrinm]

ZeroSSL is a sectigo reseller

[griffin]

Interesting. I stand corrected.

[jvanasco]

Just clarifying something…

LetsEncrypt never blocked Russian domains for simply having a .ru extension.

LetsEncrypt did (and still does) block Russian domains, regardless of extension, if they are known to be owned or controlled by an entity on the relevant US export controls list.

Russian domains are eligible for certificates, but domains owned by entities sanctioned by the US government (which may include Russians) are ineligible.

[SagePtr]

ZeroSSL indeed blocked .ru domain from issuing new certificates and even renewing old ones. I used ZeroSSL for one of my domains along with Letsencrypt for other domains, and ZeroSSL stopped working for me after the half-bald moth started killing innocent people. Letsencrypt still works.