Since mid-June 2026, Russian authorities have sharply stepped up their push for domestic security certificates. The Ministry of Digital Development (“Mintsifry”) announced that website owners can obtain a free TLS certificate from the National Certification Authority through the Gosuslugi state services portal. The entire procedure takes three working days. Some government-owned banks fell in line almost immediately. T-Bank, Rosselkhozbank, and others started sending customers warnings about “certificate problems” and promoting domestic infrastructure.

Another external event served as the trigger. On June 13, the Japanese certificate authority GlobalSign began force-revoking SSL certificates it had previously issued to Russian companies. The revocation list covered roughly 15,000–20,000 second-level domains. Counting subdomains, the number of affected certificates could run into the hundreds of thousands. Authorities inside the country quickly capitalized on the situation.

Promoting these “home certificates” is part of a long-standing, consistent program aimed at shifting all digital trust into the hands of the government. We’ve seen this before with state-level blocking of websites and efforts to replace existing resources with “sovereign” alternatives. Certificates are the next step. They come with a direct cost to privacy: trusting one of these certificates technically means something very different from trusting an ordinary one. Combined with the traffic-filtering system already in place, it opens the door to surveillance. That’s the part worth unpacking first.

The current revocation wave is neither the first nor an isolated episode. Back in December 2023, when GoDaddy exited the Russian market, “Teplitsa” wrote about its influence on privacy.

Authorities’ actions

Mintsifry offered free TLS certificates from the National Certification Authority through Gosuslugi within three business days. The certificates are available to legal entities, individual entrepreneurs, and private individuals. Both DV and OV certificate types are available, using either RSA or GOST (the Russian state cryptographic standard) algorithms. Alongside the certificate switch, banks started warning customers about possible disruptions. T-Bank flagged login issues, and Rosselkhozbank reported errors in its older Android app.

It may seem that the government is helping out: Western certificates were revoked, and the state immediately offered a free replacement. However, previous steps toward a “sovereign Runet” (from blocking websites to promoting domestic services) followed the exact same pattern. An external restriction served as the pretext, and the result was that users and companies were moved onto infrastructure under government control. The real question is what changes once a user trusts the local certificate.

Dangerous Russian certificates

Russian certificates are not an equivalent replacement. Out of the box, only one major browser (Yandex Browser) trusts them and has the root certificate built in. The second option is Atom, another Russian browser, but that project was discontinued in 2024. All other major browsers (Chrome, Firefox, Safari, Edge, etc.) will display an error message if a user tries to open a website using a Russian certificate. Users have to manually install the “Russian Trusted Root CA” certificate into their browsers or operating systems. Such an installation carries real risks.

Once a user installs a state certification center’s root certificate, they give Russian authorities the technical capability to issue “trusted” certificates for any website that will be recognized by their device. Combined with control over network traffic, this opens the door to an adversary-in-the-middle (MITM) attack. Whoever holds the root certificate and controls the network channel can decrypt, read, and even modify traffic. They can do this without the user noticing, and browsers won’t display any warnings. Kazakhstan already attempted something similar by substituting a state certificate for the authentic Gmail certificate.

This is especially sensitive in the Russian context. Backbone internet traffic already passes through TSPU (Technical Means for Countering Threats — traffic-filtering equipment installed at ISPs as part of the “sovereign Runet” system). When the party controlling the network channel and the party controlling the certificates are effectively the same, encryption between a user and a website stops working. “Teplitsa” covered this mechanism in details.

Even major government resources, such as Gosuslugi, Roskomnadzor (Russia’s communications and media regulator), and the Defense Ministry’s websites, have historically preferred certificates issued by GlobalSign and its AlphaSSL line rather than the Russian agency.

Reasons for GlobalSign to revoke certificates

GlobalSign is one of the world’s largest certificate authorities, ranking second globally with a 20.4% market share according to W3Techs data. The company was founded in Belgium and is part of the Japanese GMO Internet Group, making it subject to EU sanctions. After 2022, when most Western certificate authorities stopped serving Russian domains, GlobalSign remained essentially the last major commercial CA still working with Russia. Astra Cloud deputy CEO Konstantin Anisimov stated that GlobalSign held about 90% of the commercial segment of Western certificates in the country. That’s why its exit hurts so much.

Hosters and IT security specialists estimate the impact at 15,000–20,000 second-level domains (with subdomains, it reaches hundreds of thousands of certificates). Mintsifry tells a different story: “In the worst case, sites and online services whose certificates are revoked may be unavailable for a short time while their owners obtain new certificates.” The ministry claims GlobalSign’s market share never exceeded 5%.

Both numbers can be accurate. The 5% figure represents GlobalSign’s share of the entire Runet, including a massive number of small sites running on free Let’s Encrypt certificates. The 90% figure represents its share specifically among paid Western certificates — the ones banks, online stores, and corporate services rely on. Mintsifry is counting the whole base, while the market is counting where it actually hurts.

Recommendations for developers and site owners

• Assess the situation. Check which of your domains and subdomains use GlobalSign certificates. You can find this in the certificate’s “issuer” field. Check whether any of your mobile apps use certificate pinning. Those will require a full app update, not just a new certificate.
• Don’t repeat the “single basket” mistake. Switching from GlobalSign to another Western CA won’t remove the systemic risk. Almost every major publicly trusted CA operates under US or EU jurisdiction and must comply with their sanctions. Resilience doesn’t come from picking the “right” vendor — it comes from architecture: automated issuance and renewal (the ACME protocol), monitoring expiration dates and revocation status, and the ability to switch CAs quickly. The same rule applies here as with censorship circumvention: reliability comes from relying on several independent sources, not one perfect vendor.
• Code signing is a separate risk. Commercial CAs like GlobalSign issue not just TLS certificates but also code-signing certificates. These allow users to install apps and drivers on Windows, macOS, or iOS without security warnings. According to IT security expert Alexey Lukatsky, Russian developers will likely have no alternatives and therefore risk losing the ability to legally distribute software. This will hit even companies whose website TLS setup is otherwise fine.
• Evaluate regulatory and security tradeoffs. Schemes like “obtaining Let’s Encrypt certificates through foreign proxy servers” carry too much regulatory risk. Switching to a Russian certificate solves the accessibility problem for Yandex Browser and Atom users, but not for others. On the other hand, it shifts the risk of installing an unsafe root certificate onto your visitors. It’s worth weighing these risks before advising users to install a Russian certificate.

Alternative solutions

• Free options with automatic issuance via ACME. For private individuals and non-state Russian companies not under sanctions, Let’s Encrypt still works (90-day certificates with auto-renewal). Similar free options include ZeroSSL, SSL.com (free DV certificates), and Actalis. Important caveat: all of these are publicly trusted CAs bound by the same sanctions rules, so they are just as restricted for sanctioned entities and state organizations as GlobalSign is. No one is immune to a targeted revocation like the one that hit the Max messenger app. Google Trust Services is a US-based CA and is clearly off-limits for sanctioned entities. Buypass, which used to appear in these comparisons, has stopped issuing TLS certificates.
• Let’s Encrypt and its policy. Indeed, the service stated it would not renew the Max messenger’s certificate, but that is not part of a massive shutdown. The service won’t serve sanctioned individuals, organizations, or Russian state entities, but that is not the same as refusing service to Russians as a whole. Let’s Encrypt recently published a document regarding compliance with sanctions rules. This text is easy to misinterpret as a blanket ban on all Russians, but that is inaccurate. Let’s Encrypt specifically clarified on Hacker News that certificates remain available to private individuals and non-governmental companies in Russia, and that the new wording simply codified a policy that had been in effect for some time.
• Paid options. Major Western CAs (Sectigo, DigiCert, Thawte, GeoTrust) are already unavailable for Russian domains. Alternatives from other jurisdictions (e.g., CIS or Chinese CAs) cost several times more, according to market participants, and offer no guarantee against a similar revocation down the road. That is simply trading one dependency for another.

Expectations

Every expert we consulted agrees on one thing: June 13 was neither the beginning nor the end, just another step. Sanctions affect a large swath of Russian companies. Certificate revocations will continue as current certificates expire and sanctions lists expand. The general expectation is that the real scale of the fallout will become clear by the end of summer 2026.

What’s happening fits the same pattern as our previous coverage. Foreign sanctions and the exit of Western companies serve as the backdrop and the pretext, but there is only one active party inside the country: the government, which consistently moves access and trust in Runet onto infrastructure it controls. First it was VPNs and censorship circumvention, then code repositories and services, and now the certificates that the padlock in your browser’s address bar depends on. The logic is always the same: someone else’s restriction becomes the argument for a “sovereign” replacement, and that replacement turns into another lever of control and surveillance. Mintsifry’s certificates are just another piece of the same puzzle.

Update, June 16: The list of revoked certificates

The Telegram channel “Technological Bolt of Genon” published a list of 287 revoked GlobalSign certificates. While it is far from a complete list (not even close to the estimated 15,000–20,000 domains), it is comprehensive enough to show how the revocation works and whom it is hitting.

The market is clearly unhappy with Russian certificates. Where are Russian websites migrating instead? Looking at the published list, many have turned to HARICA (the Hellenic Academic and Research Institutions CA), a Greek academic certificate authority. Seventy-four certificates migrated there, including nearly the entire certificate inventories of AlfaStrakhovanie and Rosselkhozbank. HARICA is a publicly trusted European CA recognized by all browsers, and it continues to issue certificates to Russian organizations. Let’s Encrypt comes in second with 43 certificates, including SOGAZ’s entire website.

Businesses have overwhelmingly chosen free, European, or Western CAs over the domestic option. Only about 19 sites moved to Russian certificates. This group was dominated by entities directly tied to the government and the Central Bank, such as NSPK (the National Payment Card System, which operates Russia’s Mir card network) and Rosselkhozbank.

This points to an uncomfortable conclusion for anyone arguing that “Russian certificates are an equivalent replacement.” Even sanctioned organizations — those facing the hardest time obtaining a Western certificate — mostly chose the European HARICA or Let’s Encrypt over the government-run CA. The state certification authority remains a minority choice even among those directly hit by the revocation, simply because mainstream browsers still do not trust Russian certificates, while HARICA and Let’s Encrypt work right out of the box.

Update, June 22: Russian certificates meet various OSes

The core problem with Russian certificates is that foreign operating systems and browsers do not trust them. Information security expert Alexey Lukatsky highlighted this while analyzing a proposal to move code signing (the mechanism a system uses to verify that an app or driver comes from a trusted developer) onto the domestic certification authority as well.

A domestic CA’s code-signing certificate would change nothing until foreign OSes started trusting its root certificate, Lukatsky noted in his Telegram post. The OS market share in Russia breaks down as follows: about 83% of computers run Windows, another 7% run Apple’s macOS, and only 3% run domestic operating systems. Everything would work smoothly on domestic OSes, but they account for a very small share of the market.

Lukatsky stated that it would be a dead end to ask users to manually install a new root certificate on Windows (or, worse, in developer mode on macOS). Deploying such a certificate across tens of thousands of computers in a large organization is an administrative nightmare. There is no technically convenient way to make this mandatory for everyone, at least not without altering the trust rules built directly into the operating systems.

According to Lukatsky, an unnamed Mintsifry representative stated that the ministry “has no information about any plans being developed to revoke foreign code-signing certificates or to ban adding new certificates as trusted in Windows.” While that sounds reassuring, Lukatsky reasonably points out that plans of this nature are typically not announced before they are implemented, as was the case with recent events involving Apple and Let’s Encrypt. In other words, denying plans for coercion makes little sense if the voluntary option is technically non-viable. The logic of “sovereignization” dictates that sooner or later, trusting the state certification authority will stop being a choice and become a mandatory requirement for any device to work within the country at all.