GlobalSign certificate revocations hit 1,300 Russian organisations

Why are SSL/TLS certificates being revoked?

A certificate is what lets a browser trust that a site is really who it says it is. Experts quoted on the matter name several possible reasons for revoking one: rules from the CA/Browser Forum (the industry body that sets standards for certificate authorities), the laws of the country where the authority is based, or complaints from third parties.

The trigger this time is a rule change. In early May, new CA/Browser Forum norms took effect that ban issuing certificates to companies on sanctions lists, and checking them became mandatory. GlobalSign began revoking certificates for Russian companies in June. RuCenter sometimes manages to negotiate to have certain companies removed from a revocation list.

HARICA first issued replacements for organisations that GlobalSign had cut off. Later it started revoking them too, and did so within seconds, leaving site owners no time to prepare.

What can affected sites do?

The alternative is the National Certificate Authority run by Russia's Ministry of Digital Development. It issues domestic TLS certificates, but they only work in Russian browsers. Sanctioned Russian banks had to switch to them, and as a result their sites no longer open properly in most foreign browsers.