Iranian banks lose SSL certificates as U.S. sanctions expand

Overview

Updated 24 minutes ago

Millions of Iranians who bank online now hit a red browser warning when they open their bank's website: 'Your connection is not secure.' Iranian banks are losing their SSL certificates, the digital IDs that prove a website is real, because the certificate authorities that issue them have stopped working with sanctioned institutions.

The revocation wave began in July, when Iran's payment switch Shaparak lost its certificate, and worsened after September 8, when the Treasury froze general licenses that had eased sanctions under a June U.S.-Iran memorandum. Banks are changing web addresses and telling customers to skip the warnings, the exact opening phishing attacks exploit. With no trusted issuer left, Iran faces self-signed certificates or a domestic authority no browser trusts by default.

Why it matters

Iranian online banking now runs on certificates global browsers don't trust, inviting phishing and pushing Iran toward a domestic certificate authority that deepens internet isolation.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

83 days

Days from U.S.-Iran detente to sanctions reversal

The June 17 memorandum of understanding to the September 8 Operation Economic Outcast.

Iranian financial institutions affected

Central Bank of Iran, Shaparak, Bank Melli, and Bank Mellat have lost certificates or changed domains.

Certificate paths remaining for Iranian banks

Self-signed certificates with no third-party verification, or a domestic authority no browser trusts by default.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Organizations Involved

U.S. Treasury — Office of Foreign Assets Control (OFAC)

U.S. Treasury agency

Launched Operation Economic Outcast on September 8, 2026, freezing Iran general licenses

OFAC administers U.S. economic sanctions, including the Iran program that now extends to digital certificate infrastructure.

Let's Encrypt (Internet Security Research Group)

Nonprofit certificate authority

Added U.S. sanctions compliance clause to its user agreement in summer 2026

Let's Encrypt issues free SSL certificates trusted by all major browsers; its summer 2026 agreement change restricts issuance to sanctioned Iranian entities.

Central Bank of Iran

Central bank

Its own information-site certificates revoked; advised users to bypass browser warnings

The Central Bank's certificates were revoked by an external provider without notice; it told users they could proceed past browser warnings to reach services.

Shaparak

Payment network operator

First major Iranian payment entity to lose its SSL certificate, July 2026

Shaparak operates Iran's electronic payment switching network; its certificate revocation marked the start of the banking crisis.

Bank Melli Iran

State-owned bank

Changed website address after losing certificate

Iran's national bank introduced new web addresses alongside its known domain to preserve customer access.

Bank Mellat

Commercial bank

Changed domain without redirecting old address

Bank Mellat moved to a new domain without redirecting its old one, raising phishing concerns.

Timeline

June 2026 September 2026

7 events Latest: Today

Tap a bar to jump to that date

September 2026
Scale of Iranian bank certificate loss documented
Today Current event

Banks send customers SMS with updated addresses as revoked certificates force domain changes.
Today
OFAC imposes presumption of denial
Sanctions

Iran-related specific license applications face presumption of denial; aviation designations added.
4 days ago
Treasury launches Operation Economic Outcast
Sanctions

OFAC stays general license J-1 and related authorizations, freezing eased Iran sanctions; designates VTB Bank.
6 days ago
August 2026
Bank Melli and Bank Mellat lose certificates, change domains
Infrastructure

Major banks begin switching web addresses as certificate failures spread through the banking sector.
August 20th, 2026
July 2026
Shaparak loses SSL certificate
Infrastructure

Central Bank confirms Shaparak's certificate revoked by external provider without prior notice.
July 20th, 2026
Let's Encrypt adds sanctions compliance clause
Policy

Free certificate authority adds U.S. sanctions language, restricting issuance to sanctioned Iranian entities.
July 2026
June 2026
U.S. and Iran sign memorandum to ease sanctions
Diplomatic

Memorandum meant to ease U.S. sanctions and begin reconciliation between the two countries.
June 17th, 2026

Scenarios

Iran launches a domestic certificate authority

Likely Resolves by Mar 14, 2027

Discussed by: Iranian cybersecurity analysts cited in Nooshdaroo and 24news coverage

With no global certificate authority willing to certify sanctioned Iranian banks, Iran's Telecommunications Ministry or Central Bank establishes a national root certificate authority. Because no browser trusts it by default, citizens must install its certificate manually on each device. If those root keys leak or are compromised, attackers could impersonate any Iranian website and intercept encrypted traffic.

Sanctions expansion reaches more Iranian digital infrastructure

Likely Resolves by End of 2026

Discussed by: Skadden and Paul Weiss client memos on Operation Economic Outcast

OFAC continues targeting Iranian digital and financial infrastructure plus third-country firms supporting it. More government sites, payment processors, and possibly cloud services lose access to Western infrastructure. Additional designations of Iranian technology firms or further certificate revocations would mark the expansion.

U.S.-Iran reconciliation resumes, restoring certificate access

Unlikely Resolves by Jun 17, 2027

Discussed by: National Law Review analysis of the June memorandum and its reversal

If the U.S. and Iran restart the reconciliation that the June memorandum began, OFAC could issue a general license allowing certificate authorities to work with sanctioned Iranian institutions. That would let certificate authorities renew certificates and restore browser trust. The scenario requires a diplomatic shift that currently shows no signs of occurring.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

February 2022

Russia's 2022 tech isolation

After Russia invaded Ukraine, Western cloud providers, payment processors, and certificate authorities cut access. Russian organizations lost HTTPS validity and moved to domestic providers like VK.

Then

Many Russian sites lost HTTPS or went down; insecure workarounds became common.

Now

Russia accelerated its domestic technology infrastructure, widening the split between Russian internet services and the global web.

Why this matters now

Shows what happens when a country's web infrastructure depends on foreign trust systems that can be cut off, and the domestic alternatives that follow.

2010s-present

Iran's National Information Network

Iran spent over a decade building a domestic internet infrastructure called the National Information Network, which routes traffic domestically and supports state filtering.

Then

The network provides domestic services and gives the state control over access.

Now

It has served as a tool for both self-reliance and censorship as sanctions isolate Iran further.

Why this matters now

The SSL crisis gives Iran a new reason to route banking through the national network with domestic certificates, deepening the country's internet isolation.