Chinese Firm Revokes Web Credentials for Iran's Sanctioned Strait Authority After U.S. Warning

A Shanghai-based internet security firm, TrustAsia, provided and subsequently revoked digital credentials for Iran's sanctioned Persian Gulf Strait Authority (PGSA), enabling Tehran to temporarily vet vessels, collect tolls in the Strait of Hormuz, and operate online despite U.S. sanctions. The incident highlights the complexities of enforcing U.S. sanctions against entities operating in critical international shipping lanes.

TrustAsia issued an automated domain-validated certificate to the PGSA, a routine process that verifies website domain control but typically does not involve deep vetting. According to global internet monitors, this allowed the PGSA to regain secure online access for approximately four days before the credentials were withdrawn. The PGSA had previously stated on August 10 that its website was disrupted due to "the enemy's political influence on the internet service provision systems."

U.S. sanctions experts, including Jeremy Paner of Hughes Hubbard & Reed, urged TrustAsia to review its compliance program, warning the firm to act "before it is too late." Paner noted that the U.S. possesses broad authority to impose sanctions on non-Iranian companies that provide services to sanctioned Iranian entities, a measure that could include providing digital security certificates. He emphasized that such services could be deemed material support to sanctioned entities under Executive Order 13224, regardless of whether the service was knowingly provided.

Alp Toker, CEO of NetBlocks, told Fox News Digital that the loss of standard SSL/TLS certificates after the PGSA was added to the U.S. Office of Foreign Assets Control (OFAC) sanctions list on May 27 made the website inaccessible through standard browsers. This forced shipping firms to use unencrypted connections, potentially exposing their data to interception, although no breaches have been publicly reported.

"The digital transparency records are authoritative on this," Toker said, adding that the site's inaccessibility forced traffic into a format that could be readily intercepted, potentially making it easier for authorities to read communications and identify collaborating shipping firms.

On August 17, the PGSA announced that its secure website, pgsa.ir, was once again accessible. The authority also stated that if the issue recurred, an HTTP domain would be temporarily available using the Firefox browser.

The U.S. Treasury Department designated the PGSA in May, stating it "spearheads an Iranian-controlled scheme that flagrantly violates international law and U.S. sanctions" by extorting vessels transiting the Strait of Hormuz. The department warned that any entity cooperating with the PGSA could face sanctions risk for providing support to the Islamic Revolutionary Guard Corps (IRGC).

TrustAsia, which bills itself as a leading certification authority in China, confirmed issuing a "Domain Validated TLS certificate for pgsa.ir." The firm stated that its automated validation process does not verify the legal identity, affiliation, or sanctions status of the entity operating the domain. Following a review, TrustAsia added the entire pgsa.ir domain namespace to its restricted-issuance list and planned to revoke the existing certificate.

Toker confirmed that TrustAsia's certificate privilege was withdrawn on August 21. He explained that this action signals the issuer's withdrawal of trust, typically due to customer misuse or breaches of terms of use, and will cause the secure website to cease functioning in most browsers unless a new certificate authority is found.

Paner suggested that TrustAsia should have assessed the reputational and legal risks associated with providing services to sanctioned entities. He noted that this situation aligns with broader warnings from U.S. officials about forthcoming sanctions, particularly targeting Chinese tech companies providing services to the IRGC.

Treasury Secretary Scott Bessent recently announced expanded sanctions against nearly 60 Iran-linked individuals, entities, and vessels as part of "Operation Economic Outcast," aimed at targeting Tehran's global financial networks. TrustAsia was not among those sanctioned in this round. A spokesperson for the Chinese Embassy stated they were unaware of the specifics of the situation and had no information to provide.