6 minWorld
Chinese Firm Briefly Restored Iran's Hormuz Toll Portal Before Revoking Access
A Shanghai-based certificate authority issued digital credentials that let Iran's sanctioned Persian Gulf Straits Authority collect Strait of Hormuz tolls for four days, then revoked them after U.S. sanctions experts warned of enforcement risk.
A Shanghai-based internet security firm briefly restored secure online access for Iran's sanctioned Persian Gulf Straits Authority, allowing Tehran to vet vessels and collect tolls in the Strait of Hormuz for four days before the credentials were revoked, according to global internet monitors.
TrustAsia Technologies issued an automated domain-validated TLS certificate to the PGSA, a routine process that verifies control of a website domain through server checks and typically does not involve manual vetting or background checks. The move prompted U.S. sanctions experts to urge the firm to review its compliance program before offering further services to the IRGC-linked maritime authority.
The PGSA first said its website was disrupted on Aug. 10 because of what it described as the enemy's political influence on internet service provision systems, according to a post on X. NetBlocks CEO Alp Toker said the authority had lost its web security credentials after the entity was added to the U.S. Office of Foreign Assets Control sanctions list on May 27.
The loss of standard SSL/TLS certificates made the PGSA website inaccessible using standard browsers, Toker said, forcing shipping firms to use unencrypted connections that could leave their data vulnerable to interception. While no data breaches resulting from the use of these connections have been made known, and there are no known instances in which a shipping firm's data was intercepted and used to its detriment because of the certificate expiration, Toker said the site's inaccessibility resulted in a shift to what he described as insecure protocols.
«The digital transparency records are authoritative on this,» Toker said, adding that the measure forced the traffic into a format that could be readily intercepted. «This is a class of vulnerability open to government exploitation, rather than a corporate breach or personal data leak.»
Toker claimed this could make it easier for authorities to read communications sent through the platform, potentially identifying shipping firms collaborating with the PGSA. «The net result was that the website was more difficult to access, because most web browsers strongly encourage the use of secure HTTPS,» Toker said, adding that any form submissions could have been easily eavesdropped on because they were no longer encrypted in transit.
The PGSA said six days later, on Aug. 17, that the issue had been resolved and that the secure domain was once again available for submitting requests using any browser. It added that if the issue recurred, the HTTP domain would again be temporarily available using the Firefox browser.
Toker confirmed that Iran had turned to TrustAsia, which he said issued new digital security credentials to the PGSA despite the U.S. sanctions, restoring secure access to its website. The Chinese firm bills itself as a leading and professionally certified certification authority in China with a focus on trusted, secure and cryptographic communications in the digital world.
«Almost all of these root authorities do business with the U.S., so they tend to comply with U.S. sanctions,» Toker said. But TrustAsia, he noted, had gone its own way, building a China-first certificate infrastructure that sidesteps the West. Toker said TrustAsia had simply gone ahead and issued Iran's PGSA with a new certificate, and Iran was once again collecting revenue from ships passing the Strait via its secure online portal.
Jeremy Paner, a partner at Hughes Hubbard & Reed, warned that U.S. authorities would have enforcement powers over such actions. «The U.S. has incredibly broad authority to impose sanctions on non-Iranian companies that provide any sorts of services to sanctioned Iranian companies,» he said. «Many times, that authority will be abbreviated or explained as being providers of material support to sanctioned Iranian companies. But in fact, any level of services whatsoever could be the basis for the United States imposing sanctions against the company for providing services to Iran.»
Paner said restoration of the certificate was unequivocally sanctionable, describing it as a service provided to the PGSA that could be the basis for imposing sanctions pursuant to Executive Order 13224, as amended. He added that the authority does not require that the service be knowingly provided to the PGSA, meaning the automated nature of the service is irrelevant and does not make it any less sanctionable.
In a statement on Aug. 20, a spokesperson for TrustAsia confirmed that the firm issued a domain-validated TLS certificate. The Treasury Department said in May when designating the entity that Iran's IRGC extorts vessels transiting the Strait of Hormuz through the so-called Persian Gulf Strait Authority, adding that the PGSA spearheads an Iranian-controlled scheme that flagrantly violates international law and U.S. sanctions.
«Anyone cooperating with the so-called strait authority may be providing support to and receiving services from the IRGC, which ultimately benefits from this attempted extortion, and may therefore be exposed to sanctions risk,» the Treasury Department warned.
