Trusting Russian Root Certificates and Monitoring Domestic CT Logs
The discussion around trust in Russian root certificates issued by the Ministry of Digital Development and Communications has intensified following recent issues with GOST certificates on Gosuslugi. Users are weighing the security implications of adding these roots to system stores, browser profiles, or relying on Yandex Browser where they are pre-installed.
Root certificates themselves do not compromise systems, yet placing them in trusted stores creates a pathway for traffic interception. Entities with access to network flows via the TSPU system can issue intermediate certificates signed by the Russian root and perform real-time MitM attacks against sites such as gmail.com or telegram.org.
Defensive measures remain limited. One approach involves isolating the Russian roots to a dedicated browser profile used only for domestic sites that require them. Advanced configurations can further restrict the roots to specific domains such as *.ru.
Certificate Transparency as a Mitigation
Certificate Transparency logs record every issued certificate in an append-only structure, embedding proof of inclusion inside the certificate. Yandex Browser refuses certificates lacking a valid SCT from approved logs, significantly raising the bar for undetected MitM operations and leaving forensic traces.
Other browsers automatically disable CT verification for chains anchored to manually added roots, treating them as corporate environments. This behavior reduces visibility into potential abuse of Russian intermediates.
Domestic CT Logs
Three primary logs are recognized by Yandex:
- Yandex Agate Log (2026 and 2027 instances)
- VK NCA Log (2026 and 2027 instances)
- Ministry of Digital Development and Communications Log (2026 and 2027 instances)
Log endpoints rotate yearly, and the authoritative list is published at browser-resources.s3.yandex.net/ctlog/ctlog.json.
Verification Tools
Public monitors such as ct.tlscc.ru have shown gaps in coverage for newer log addresses and certain active certificates. A Python utility was developed to fetch the current log list, parse embedded SCTs, reconstruct precertificates, and query each domestic log via the standard CT HTTP API for inclusion proofs.
Related articles
Evaluating Secure Development Maturity: Comparing BSIMM, DSOMM, SAMM and GOST R 56939-2024
A detailed analysis compares four methodologies for self-assessing secure software development maturity in Russian companies. The review covers BSIMM from Black Duck, OWASP DSOMM, OWASP SAMM and the updated Russian national standard GOST R 56939-2024. Each model was tested through a simulated audit on a fictional company called ООО «Лиса и лосЬ» that uses GitLab, Nexus and SonarQube. The evaluation scored the methodologies on criteria including ease of maturity calculation, recommendation generation, roadmap building, heat-map creation and SDLC coverage. GOST R 56939-2024 and SAMM received the highest total scores of 35 and 34 out of 47. The article concludes that no single methodology covers all needs and recommends combining approaches tailored to specific company contexts.
GlobalSign Launches New Wave of SSL/TLS Certificate Revocations Targeting Russian Organizations
GlobalSign has initiated another round of revocations affecting SSL/TLS certificates issued to Russian websites, with a total of 11,000 certificates withdrawn from 1,300 organizations so far. The revocations primarily impact entities listed in EU and US sanctions regimes, in line with updated CA/Browser Forum requirements that took effect in May 2026. Greek CA HARICA has also participated in the revocations, sometimes completing the process within seconds and leaving site owners little time to respond. The actions stem from mandatory checks against the OFAC SDN List, BIS Denied Persons List, and equivalent European sanctions databases. Russian authorities recommend obtaining domestic TLS certificates via Gosuslugi within three business days to maintain secure access in foreign browsers. Let's Encrypt has similarly updated its policies to restrict certificates for sanctioned Russian entities while continuing issuance for others.
Kaspersky Container Security Earns FSTEC Russia Certification as Antivirus Protection Tool
Kaspersky Container Security has received official certification from FSTEC Russia under certificate number 5122 dated October 23, 2026. The product was validated as a means of antivirus protection and meets the regulator’s requirements at the fourth level of trust. It also complies with the protection profile of type B for the fourth class, designated IT.SAVZ.B4.PZ. The certification enables deployment of the solution in government information systems, personal data processing environments, critical information infrastructure facilities, and industrial control systems. Specific usage must still align with individual system requirements and the conditions stated in the certificate. The solution has been listed in the Russian software registry maintained by the Ministry of Digital Development since 2023. Primary audiences include government agencies, large enterprises, and industrial operators that rely on containerized workloads inside regulated perimeters.
Russian Lawmaker Clarifies Apple and Microsoft ORI Registry Listing Does Not Ban Products
State Duma deputy Anton Nemkin stated that the inclusion of Apple and Microsoft in Russia's ORI registry imposes standard data retention obligations without automatically prohibiting their products. The registry entry requires companies to store user information and message exchange records in Russia for three years and message content for up to six months. Nemkin emphasized that these rules apply equally to Russian and foreign digital market participants regardless of business scale or country of registration. The companies were added on October 2, 2026, while Google Meet has been listed since January 26. Although the status mandates data provision to authorized bodies in legally defined cases, the listing itself does not confirm that corporations will share Russian users' correspondence with the state. Non-compliance may trigger separate regulatory measures, but the deputy urged against exaggerating consequences through sensational headlines.