Posted by piskov 6 days ago
In reality of course you can probably just ignore this as long as you request the certificate from a proxy in a nonsanctioned country and you don't stick out to the government.
Especially since sanctions are transitive. Mozilla and Google, being US companies, are actually not allowed to trust any entity whose purpose is to work around sanctions. Their members could go to jail for that.
They also likely would have to implement some kind of domain name screening, just like banks have to block transfers that mention "Havana" or "Tehran".
They are currently not doing anything, even ccTLD blocks. They have issued certificates for .kp domains this month and in August of last year.
Iran and other tyrannical governments can easily set up their own CAs and force their citizens to use them. Iran likely already has this infra in place. This ban does nothing but highlights LE as the liability it is. The decades-old certificate authority scheme is no longer fit for purpose and needs to go.
If you're a web developer, consider offering your site through public key-addressable networks. Reticulum and Tor are good options that work today.
Whatever USofA, it's not hard to have their own cosmodrome and certificates.
Tangential, in 2026 website certificates feel like nothing, disposable automation artifact, toxic max-security[1], vehicle for those who rent seek, fingerprint.