For a brief four‑day period in August, Iran’s Persian Gulf Straits Authority (PGSA) regained secure online access after the Chinese certificate authority TrustAsia Technologies issued an automated domain‑validated TLS certificate for the agency’s website. The certificate enabled the PGSA to vet vessels, collect tolls for ships transiting the Strait of Hormuz, and operate its portal despite U.S. digital restrictions.
How the certificate was issued
TrustAsia, which markets itself as a leading Chinese certification authority focused on “trusted, secure and cryptographic communications,” follows a routine automated process that validates control of a domain through server checks. The process does not involve manual vetting of the applicant’s legal or sanctions status. As a result, the firm issued a new certificate for pgsa.ir without confirming the entity’s inclusion on the U.S. Office of Foreign Assets Control (OFAC) sanctions list.
U.S. reaction and compliance concerns
NetBlocks CEO Alp Toker explained that the PGSA lost its standard SSL/TLS certificates after being added to OFAC’s sanctions list on May 27, rendering the site inaccessible via standard browsers. The temporary certificate restored HTTPS access, allowing shipping firms to submit requests securely.
U.S. sanctions experts, including Jeremy Paner of Hughes Hubbard & Reed, warned that providing any service to a sanctioned Iranian entity is “unequivocally sanctionable” under Executive Order 13224. Paner emphasized that the automated nature of the certificate issuance does not excuse the service from sanction liability.
Revocation and aftermath
On August 21, TrustAsia announced the revocation of the certificate and added the entire pgsa.ir domain to its restricted‑issuance list to prevent further issuance. The firm described the revocation as a precautionary compliance measure, not an admission of technical error.
According to Toker, the revocation will cause most browsers to reject the site’s security, forcing the PGSA to rely on unencrypted connections or seek another certificate authority willing to issue a new certificate.
Implications for Iran’s revenue collection
The PGSA, designated by the U.S. Treasury Department as an entity linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), is accused of extorting vessels passing through the Strait of Hormuz. The brief restoration of secure online access allowed the agency to continue collecting tolls, a revenue stream the United States seeks to curtail.
While no data breaches have been reported from the period of unsecured connections, Toker warned that the use of insecure protocols could expose shipping firms to government interception, potentially revealing collaboration with the PGSA.
Broader context
This episode highlights the challenges of enforcing U.S. sanctions on digital infrastructure when automated certificate issuance processes can bypass traditional compliance checks. It also underscores the strategic importance of the Strait of Hormuz, a vital chokepoint for global oil shipments, and the ongoing U.S. effort to limit Iran’s ability to profit from maritime traffic.
Original reporting: Fox News (HLL/CB) — read the source article.
