The non-profit certificate authority Let’s Encrypt, community-controlled and providing certificates free of charge to anyone, has made an amendment to its user agreement defining the rights and obligations of certificate recipients. A clause has been added to the section on the terms of requesting and using certificates, prohibiting the issuance of certificates to individuals and organizations permanently residing or registered in countries or territories subject to comprehensive U.S. sanctions.
In addition, individuals and organizations subject to personal sanctions and U.S. export control restrictions, as well as organizations controlled by sanctioned individuals or acting on their behalf, are also prohibited. It is noted that Let’s Encrypt is registered in the U.S. and is required to comply with the export control rules and sanctions in effect in the U.S.
It remains unclear whether the amendment to the user agreement is a formality reflecting already applied practices or if additional measures will be implemented to block requests from subnetworks for countries under sanctions. Until now, Let’s Encrypt has applied targeted blocks preventing certificate issuance for specific domainscountries listed in the U.S. Office of Foreign Assets Control (OFAC) sanctions lists.
Comprehensive U.S. sanctions
are imposed against Crimea, the DPR, LPR, Iran, North Korea, and Cuba. Strict sanctions have been imposed against the Russian Federation, but a full embargo is not currently in place. At this time, requests to Let’s Encrypt for certificates from the Russian Federation for domains not mentioned in the sanctions lists are accepted without restrictions.
Addition: Commenting on the amendment to the user agreement, the director of ISRG (Internet Security Research Group), the founder of the Let’s Encrypt project, explained that certificates will continue to be issued to individuals and non-governmental companies from Iran and Russia, but will not be available to Russian and Iranian government institutions. According to a representative of Let’s Encrypt, the changes merely document a long-established practice to fulfill legal formalities and no new blocks will follow.
The ability to issue certificates for private institutions and individuals in sanctioned territories is enabled by current U.S. laws on the protection of private correspondence and relaxations adopted by the Office of Foreign Assets Control (OFAC) to promote respect for human rights and freedoms on the internet.
Source: opennet.ru
