The posted PDF was a redline of Let’s Encrypt’s subscriber agreement that added sanctions language broad enough to read as “no certificates for people or entities in comprehensively sanctioned territories.” That landed badly because Let’s Encrypt is not a niche vendor. It is the default free certificate authority for a huge slice of the web, and many operators have internalized “just use Let’s Encrypt” as if that were neutral infrastructure rather than a legal and policy chokepoint. People immediately read the text as a ban on residents of places like Iran, Crimea, and other sanctioned regions using or renewing certs, with the usual downstream fear that governments in those places would push users onto local root certificates and make interception easier.
The most useful clarification came from Let’s Encrypt itself. A representative said the update was meant to better reflect existing legal obligations, not mark a major service change, and said certificates remain available in Iran and Russia for non-government entities under statutory exemptions and specific
OFAC authorizations tied to personal communications and internet freedom. That narrowed the practical impact a lot, but it did not rescue the document language. Multiple people pointed out that the actual text still reads much broader than the explanation, especially because it covers people “ordinarily resident” in sanctioned territories and applies at the subscriber-agreement level rather than obviously per certificate. Late in the conversation, someone noted the section appeared to have been removed again, which reinforced the sense that the wording was sloppy and likely headed for revision.
Where the conversation landed was less about whether Let’s Encrypt had suddenly cut off half the world and more about what this says about
Web PKI. Certificates are not just crypto. They are governance encoded as browser trust stores,
CA contracts, revocation policy, export controls, and sanctions law. Moving a CA out of the US might reduce one source of pressure, but it does not make trust apolitical. It just changes which legal system and which root programs sit on top. Several people pushed for alternatives like an EU-backed CA, Actalis, ZeroSSL,
DANE, or national roots, but none of those escaped the basic problem. Browser trust is hard to win, many “alternatives” still have US ties, and systems like DANE simply move power from CAs to DNS operators, registries, and governments. The practical conclusion was blunt: the internet’s trust layer is centralized enough that sanctions language in one CA’s terms can create real operational uncertainty, and operators should stop pretending CA choice is purely a technical detail.