Why Legitimate Russian Websites Fail to Load With or Without VPN: TSPU RKN Blocking and MinTsifry Certificates Explained
Russian users continue to encounter difficulties opening legitimate domestic websites both with VPN enabled and when connecting directly. The root causes involve TSPU (Technical Means of Countering Threats) devices mandated for every ISP, Roskomnadzor filtering policies, and the shift to national MinTsifry certificates that foreign browsers reject.
TSPU units inspect all traffic passing through Russian providers. Their primary function is to locate and block prohibited content while also restricting certain foreign VPN services. Because these devices sit in the path of every connection, they can interfere with otherwise legal traffic under specific conditions.
Scenario 1: ERR_CONNECTION_TIMED_OUT when using VPN
When a VPN is active and the user attempts to reach a Russian-hosted site, the browser returns ERR_CONNECTION_TIMED_OUT. The error occurs because the TCP handshake never completes; TSPU drops the foreign-origin connection to a Russian IP address. Sites hosted on foreign IPs, such as certain RUVDS instances, load normally. The recommended fixes are to configure split tunneling so that .ru, .рф and .su domains bypass the VPN, or to route specific applications such as Edge outside the tunnel while keeping Chrome inside it.
Scenario 2: ERR_CERT_AUTHORITY_INVALID without VPN
Direct connections to major Russian banks produce ERR_CERT_AUTHORITY_INVALID. The sites now present certificates issued by the National Certification Center of the Ministry of Digital Development (NUC MinTsifry). Because Chrome, Edge, Safari and Firefox do not include this root in their trust stores, the connection is flagged as insecure. Affected domains include alfabank.ru, psbank.ru, vtb.ru and sberbank.ru. Users who confirm they are visiting the genuine site can proceed via the advanced settings warning, or they can install the MinTsifry root certificate on their operating system. Browsers that already trust the certificate by default include Yandex Browser, Atom and Chromium-Gost.
Scenario 3: Partial loading or ERR_CONNECTION_TIMED_OUT without VPN
Some pages fail to load images or scripts even without a VPN. The cause is TSPU fingerprinting of older browser versions. Updating Chrome or switching to Firefox usually resolves the issue.
Recommendations for site owners and developers
Administrators should disable TLS 1.3, enable HTTP/2 support, and, if SSH access to the server IP is also blocked, obtain a new IP address. Many newly provisioned Russian VPS addresses are already filtered by TSPU before any content is published.
Related articles
OBEP Raids on Russian IT Firms: How to Safeguard Source Code, Servers and Blockchain Assets During Searches
Russian IT companies, Web3 projects and fintech services now face frequent visits from OBEP operatives conducting pre-investigative checks or searches under criminal cases. The article details the legal distinction between operational-search measures and formal searches, emphasizing article 164.1 of the UPK RF that prohibits seizure of physical servers in economic crime investigations. It explains how companies can demand data mirroring instead of hardware removal and how to invoke article 51 of the RF Constitution when pressured for encryption keys. Commercial secret regimes are presented as a tool to raise criminal liability for leaks and to request closed court proceedings. Practical checklists cover document verification, staff instructions, password retention and immediate calls to specialized criminal counsel. The guidance aims to prevent business paralysis while preserving evidence integrity during raids.
RWB Deploys Enterprise-Wide Database Access Control with Trino and Open Policy Agent
RWB has replaced fragmented manual database access processes with a centralized architecture built on Trino as the single entry point and Open Policy Agent for policy enforcement. The system enforces least-privilege access, mandatory auditing, and automated revocation tied to HR records while eliminating anonymous and password-based logins. Access requests now complete in 3–10 minutes instead of an average of four days, with 92 percent handled automatically. Key components include Keycloak for OIDC authentication, Vault for secrets, Kafka for security event streaming to SOC, and Kubernetes orchestration. Responsibility is split across AI & Data Security, Core DevOps, Access Management, SOC, and Trust & Safety teams. More than 1,250 PostgreSQL clusters and 90 projects are now connected, with real-time dashboards tracking adoption and policy health.
Russia Moves to Allow Biometric Data Processing for Suspects and Convicts Without Consent
Russian law enforcement agencies may soon gain the legal right to process biometric data of suspects, accused individuals, and convicted persons without requiring their personal consent. A corresponding draft bill has already been submitted to the government and is scheduled for review at the next cabinet meeting, according to TASS. The measure covers fingerprints, facial images, voice recordings, and other physiological or behavioral characteristics used for identification. If approved, prior permission from the individual will no longer be needed when biometrics are used in criminal proceedings. The change applies not only to those already convicted but also to suspects and accused persons whose guilt has not yet been established by a court. For ordinary citizens, enrollment in the Unified Biometric System remains voluntary and is used for remote identity verification when accessing financial and government services.
FAS Clears Russian Operators on 'Unlimited' Internet Claims Despite Speed Throttling to 128 Kbit/s
The Federal Antimonopoly Service has declined to investigate complaints regarding promises of unlimited internet and unrestricted roaming access made by major Russian mobile operators. The Association of Professional Users of Social Networks and Messengers argued that operators including Vimpelcom, MegaFon, MTS, and T2 Mobile mislead customers by advertising unlimited plans while throttling speeds to 128-512 Kbit/s after data caps are reached. FAS determined that information on official company websites does not qualify as advertising under Russian law. Operators maintain that the term unlimited remains accurate because no total data volume limit exists, only speed reductions detailed in service descriptions. The complainants and legal experts contend that FAS reviewed only technical parameter pages and ignored banners, promotional news, search ads, SMS, and push notifications that may meet legal criteria for advertising. The decision leaves consumers facing slow connections unsuitable for video or file downloads after initial allowances are exhausted.