Internet users in Russia are facing a digital crisis triggered by Western sanctions. After international certificate authorities stopped providing services to Russian entities, the Digital Development Ministry is calling on citizens to manually install security certificates from the state National Certification Center (NUTs) or switch to Yandex Browser.
The crisis deepened in the summer of 2026 when international certificate authority GlobalSign began mass revoking TLS certificates issued to Russian organizations. Around the same time, free certificate provider Let's Encrypt also stopped issuing new certificates to Russian state institutions. These developments left critical state services—including the 'Maks' messaging app, major banks, and the Federal Tax Service—without valid certificates.
In response, Russia urgently established the National Certification Center (NUTs) in 2022 following the military operation in Ukraine and the ensuing sanctions. The center began issuing free TLS certificates signed with the Russian Trusted Root CA root certificate. However, these certificates are not included in the trust lists of global browsers such as Chrome, Firefox, Safari, and Edge. Currently, only Yandex Browser and VK's 'Atom' browser trust NUTs certificates by default.
Security risks and the man-in-the-middle threat
Independent cybersecurity experts say the greatest danger of Russia's national certificate system lies in man-in-the-middle (MITM) attacks. When a user adds the NUTs root certificate to their system, they are effectively accepting that the center can generate certificates for any website. In theory, this means forged certificates could be produced even for Gmail, Telegram, or banking sites, allowing user traffic to be monitored or redirected.
Experts emphasize the system opens the door to two core threats: passive surveillance and active interference. In passive surveillance, the internet service provider can read the contents of encrypted traffic. In active interference, traffic can be altered in real time—malicious code can be injected into a web page, or content can be censored.
The Kazakhstan precedent
These risks are not theoretical. Neighboring Kazakhstan began forcing its citizens to install a national security certificate in 2019 and used those certificates to decrypt traffic to services such as Gmail and Facebook. According to 2021–2024 data from the independent research project OONI, Kazakh authorities used national certificates to carry out MITM attacks targeting Russian sites including compromat.ru and regnum.ru.
Yandex Browser's control mechanism
The Digital Development Ministry is promoting Yandex Browser as a way to mitigate risks. Rather than blindly trusting NUTs certificates, Yandex Browser requires them to be logged in a Certificate Transparency (CT) log. The browser verifies the Signed Certificate Timestamp (SCT) embedded in the certificate, confirming it has been recorded in a transparent public register.
Currently, three CT logs are operating for NUTs—one each belonging to Yandex, VK, and the Ministry. Yandex Browser specifically requires an SCT from Yandex's own log, creating a control layer that prevents the Ministry from unilaterally producing and using certificates.
However, experts note that Yandex is a company operating under Russian jurisdiction, and it remains unclear whether it could refuse to add entries to the log in the event of a state-directed MITM attack. In addition, a 2023 claim by a researcher that certificates for certain domain names were absent from CT logs has raised further questions about the system's reliability.
In the end, Russian internet users are confronting heightened surveillance and cyberattack risks in a digital transformation process triggered by Western sanctions. Experts are of the view that manual certificate installation creates a system-wide security vulnerability, while Yandex Browser limits the risk but does not eliminate it entirely.
