Let's Encrypt Updates Subscription Agreement to Ban Sanctioned Territories
Let's Encrypt has updated its Subscription Agreement to explicitly prohibit the issuance and use of certificates for users located in territories subject to comprehensive U.S. sanctions. This move aligns the service with U.S. export control and sanctions laws, effectively banning users in sanctioned regions from legally utilizing the service.
New Compliance Requirements in the Subscription Agreement
As of June 4, 2026, Let's Encrypt has added a specific clause to its Subscription Agreement requiring users to warrant that they are not a prohibited party. The updated language states that a user is not a person or entity that is:
(a) located in, organized under the laws of, or ordinarily resident in any country or territory that is the target of comprehensive U.S. sanctions; (b) a prohibited or restricted party under U.S. or other applicable sanctions and export control laws and regulations; or (c) owned or controlled by or acting on behalf of anyone described in (a) or (b).
Furthermore, the agreement now explicitly requires that users "agree to use Let’s Encrypt Certificates and any services provided by or on behalf of ISRG in compliance with applicable U.S. export control and sanctions laws and regulations."
Impact on Global Web Security and Privacy
The restriction of accessible encryption tools to sanctioned territories creates a significant security gap for users in those regions. Technical community members have noted that by removing access to a trusted, free certificate authority (CA), users in sanctioned countries may be forced to rely on government-controlled root certificates.
As soon as all local services will stop working in sanctioned countries, those countries' governments will force all users to either install a root certificate or lose access to all local services and websites. And then it will be possible to use that root certificate for MITM attacks.
This shift potentially enables state-level Deep Packet Inspection (DPI) and man-in-the-middle (MITM) attacks, as governments can mandate the installation of specific root certificates to maintain local web functionality.
Technical and Legal Enforcement Challenges
While the agreement is now in place, the technical enforcement of these sanctions remains a point of discussion. Some observers suggest that Let's Encrypt can only effectively block specific country-code Top-Level Domains (ccTLDs) or IP addresses, but that users may still bypass these restrictions using proxies in non-sanctioned countries.
However, the legal framework is strict. Some contributors pointed out that International Traffic in Arms Regulations (ITAR) and other U.S. export rules still apply to TLS technology. Because Let's Encrypt is a U.S.-based organization (run by the Internet Security Research Group), it has no legal choice but to comply with U.S. law.
Risks of Centralization in the CA Ecosystem
The reliance of a large portion of the web's certificates on a single provider has raised concerns about the "single point of failure" regarding political and legal control. The consolidation of approximately 60% of the web's certificates under Let's Encrypt has made the service a high-value target for government pressure.
Critics argue that this centralization makes it easier for political organizations to isolate entities from the internet. Some suggest that the push for shorter certificate lifespans (e.g., 7 days) combined with centralized control allows for the rapid isolation of specific entities upon government request.
Alternatives for Sanctioned Users
For those unable to use Let's Encrypt, several alternatives have been proposed by the community, including:
- EU-Based CAs: Providers such as Actalis and ZeroSSL have been mentioned as potential European alternatives to avoid U.S. jurisdiction.
- Decentralized Networks: Some developers suggest moving toward public key-addressable networks, such as Tor or Reticulum, to bypass the traditional Certificate Authority scheme entirely.