Russian CA TCI Integrates ACME Protocol to Automate TLS Certificate Issuance
The Technical Center Internet (TCI), operating the first commercial Russian TLS certification authority under RTK-COD, has launched a production ACME interface that allows automated issuance and lifecycle management of TLS certificates.
The move responds to the global trend of shortening certificate validity periods. Although TCI is not a member of the CA/Browser Forum, the industry direction is clear: maximum lifetimes will fall to 200 days in March 2026, 100 days in March 2027 and 47 days in March 2029. Manual certificate operations are becoming impractical, prompting TCI to implement a standards-compliant ACME server described in RFC 8555.
Integration challenges
Adding ACME required more than exposing an HTTP API. The protocol’s asynchronous order states had to be mapped onto TCI’s existing certificate lifecycle while respecting security zone boundaries. CSR submission occurs only at finalization, after domain control is proven, so a dedicated order-management layer was introduced to hold validated identifiers until the CSR arrives.
Domain Control Validation was extended to support the exact ACME challenge formats. DNS-01 now expects a TXT record at _acme-challenge.<domain>, while HTTP-01 serves the token at /.well-known/acme-challenge/. Both challenges are processed through the existing DCV engine and linked to the corresponding authorization object.
All certificates continue to receive Signed Certificate Timestamps from the Russian Certificate Transparency logs operated by Yandex and VK. A separate internal CT log simulator is used in the staging environment so that test certificates do not pollute production logs.
Current capabilities and limitations
The production directory is available at https://acme.tlscc.ru/directory. Supported features include:
- HTTP-01 and DNS-01 challenges
- ECDSA P-256 end-entity keys in the ECDSA A1 hierarchy
- Certificate revocation via ACME with mandatory reason codes (keyCompromise, superseded, cessationOfOperation)
- Compatibility with standard clients that respect TCI policy
Limitations of the first release are the absence of arbitrary multi-SAN certificates, the requirement that the domain name appear in the CSR Subject/CN field, and the recommendation against CNAME delegation for DNS-01 challenges. GOST-based certificates remain available only through non-ACME interfaces.
The ACME API itself is protected by an externally trusted TLS certificate chain rather than TCI’s root, eliminating bootstrap-trust problems for clients that have never previously interacted with the CA.
Next steps
Planned enhancements include full multi-SAN support, acceptance of CSRs without a mandatory Subject/CN, additional validation methods and implementation of ACME Renewal Information (ARI) as defined in RFC 9773. ARI will allow the CA to suggest optimal renewal windows, improving load distribution and enabling rapid mass re-issuance when required.
Related articles
Russia Pushes Corporate Multibanking Forward with Updated Open API Standards
The Bank of Russia and AFT have advanced Open Banking standards that enable corporate clients to aggregate account data across multiple banks within a single interface. The new specifications cover consent management, security profiles based on STO BR FAPI and OpenID Connect, and account information retrieval for both individuals and legal entities. While the 2025 pilot results demonstrated practical use cases such as personal financial assistants and corporate multibanking, the updated standards effective from October 2026 still lack a unified initiation-of-transfer component. Developers must therefore combine the new account-data APIs with separate bank-specific payment initiation mechanisms. The article explores how accounting systems or independent fintech services could become the primary workspace for financial directors managing payments, payroll, and liquidity across several banks. It also examines real-world challenges including idempotency handling, status reconciliation after network failures, and the separation of application permissions from signer authority. Examples from the UK Open Banking Limited sweeping VRP statistics illustrate how pre-authorized variable recurring payments can streamline operations while highlighting the additional policy work required for corporate supplier payments in Russia.
Hacker Attacks as Force Majeure: Russian and International Courts Diverge on Liability for Cyber Incidents
In November 2026, Russian hosting provider Beget suffered a major cyber attack that disrupted websites, virtual servers, email, DNS, and control panels for thousands of clients. Beget notified customers of circumstances resembling force majeure under Article 401 of the Russian Civil Code but stopped short of claiming automatic court recognition. Russian courts have reached inconsistent rulings on whether DDoS attacks and ransomware qualify as extraordinary and unavoidable events, examining factors such as attack scale, provider preparedness, and contractual obligations. International cases from France, Norway, the United States, and the Netherlands further illustrate that outcomes depend on evidence of prior security measures, backup integrity, and specific contractual language rather than the mere occurrence of an attack. Key precedents include disputes involving Timeweb, Expeditors, and Nordlo Haugesund where liability was limited or denied despite confirmed incidents. The analysis shows that even when force majeure is rejected, clients often struggle to recover full losses due to liability caps and proof requirements. Businesses are advised to maintain independent backups, review service agreements, and document incidents thoroughly to protect against financial exposure.
US Mandates Removal of Acronis from Federal Systems by January 2027 Over Russian Ties
US federal civilian agencies have been ordered to remove all Acronis products from their information systems by January 27, 2027, with new purchases also prohibited. The directive from the Department of Homeland Security, signed on July 31 and published in the Federal Register on October 30, covers Acronis AG along with Acronis Inc. and Acronis SCS. A nearly decade-long review examined whether Russian developers still access the code and whether supply chain risks have been sufficiently reduced, though no specific evidence of backdoors was reported by sources. After 2022, Acronis suspended operations in Russia and relocated specialists, while in 2025 Swedish firm EQT acquired a controlling stake with approval from the US CFIUS committee. Despite over 75 percent of shares now held by Western investors, these measures proved insufficient for continued access to federal systems. The ban does not extend to the private US market.
Google to Back Unified robots.txt Standard for Blocking AI Training Data Use
Google has announced plans to support a common mechanism in robots.txt that allows website owners to opt out of having their content used for training generative AI models. The feature will be based on work by the AIPREF working group at IETF and is scheduled for rollout in 2027. Instead of issuing separate instructions to each AI provider, publishers will be able to set a single policy marker that participating companies are expected to respect. Google intends to treat an unspecified general marker the same way it currently handles its own Google-Extended directive. Existing per-company rules will continue to function, letting site owners combine a broad default with specific exceptions. The approach simplifies management as the number of AI crawlers grows, though compliance will remain voluntary and dependent on which organizations adopt the standard.