Let's Encrypt has updated its subscriber agreement to prohibit certificate issuance and usage in US-sanctioned territories, effective immediately. The change aligns the free certificate authority with American export control regulations.
The updated policy, detailed in version 1.7 of Let's Encrypt's Subscriber Agreement, bars the use of its certificates in any region subject to US sanctions. This includes territories under OFAC (Office of Foreign Assets Control) restrictions.
Let's Encrypt, operated by the Internet Security Research Group, must comply with US law to maintain its operations. The restriction applies to both new certificate issuance and continued use of existing certificates in sanctioned areas.
The move affects websites and services operating in designated sanctioned territories. Organizations in these regions will need to source certificates through alternative providers.
The policy update generated significant discussion in the developer community, with 86 comments on Hacker News reflecting concerns about internet accessibility in restricted regions and the practical implications for affected services.
Let's Encrypt previously faced similar compliance requirements and has adjusted policies accordingly. The organization continues to provide free SSL/TLS certificates globally outside sanctioned zones.
Researchers have identified stolen credentials as a critical vulnerability threatening America's water infrastructure. The exposed passwords create direct pathways for attackers to access essential systems.
Microsoft's Digital Crimes Unit has shut down EvilTokens, a phishing-as-a-service platform that compromised over 12,000 Microsoft accounts across 10,000+ organizations.
A webinar tomorrow examines critical early response decisions in Google Workspace breaches. Real-world incident analysis shows which actions limit damage and which escalate the impact.
D-Link has alerted users of a maximum-severity zero-day vulnerability (CVE-2026-86296) affecting DIR-822A dual-band Wi-Fi routers. The flaw has no available patch and public exploit code is already circulating.