Let's Encrypt's New Sanctions Check: What Certificate Subscribers Need to Know

Why Free Certificates Come With Strings Attached

Let's Encrypt has become the backbone of internet security for millions of websites, offering free SSL/TLS certificates that once seemed impossibly generous. But as the certificate authority landscape evolves, compliance requirements are getting tighter—and the latest change affects every subscriber.

Let's Encrypt now requires certificate requesters to confirm they are not individuals or entities covered by comprehensive U.S. sanctions. This isn't a minor paperwork addition. It's a fundamental shift in how the world's largest certificate authority approaches legal compliance.

What Changed Exactly?

The updated Subscriber Agreement now includes explicit language requiring subscribers to warrant that they are not:

• Located in comprehensively sanctioned jurisdictions
• Listed on restricted-party lists maintained by the U.S. government
• Acting on behalf of parties who would be prohibited from receiving cryptographic services

This essentially means you're attesting to your compliance with Office of Foreign Assets Control (OFAC) regulations before your browser-trusted certificate gets issued.

Why Now?

Let's Encrypt's decision tracks with broader regulatory tightening across the cybersecurity industry. As certificate authorities increasingly find themselves at the intersection of geopolitics and technology, they're facing pressure to demonstrate due diligence in their issuance processes.

The Russia-Ukraine conflict accelerated this trend significantly. Multiple CAs began refusing to issue certificates to Russian and Belarusian entities, and some revoked existing certificates. Let's Encrypt's update brings them in line with industry expectations without making headline-grabbing exclusion decisions.

Does This Affect You?

For the vast majority of developers, startups, and website owners, the practical impact is minimal. If you're operating a legitimate website from an unsanctioned jurisdiction, you'll simply check a box during certificate issuance and continue as normal.

However, this serves as an important reminder:

• Global compliance isn't just for enterprises anymore. What was once a concern only for large corporations handling international transactions now touches individual developers and small projects.
• Free doesn't mean unregulated. Certificate authorities operate under strict audit requirements and legal frameworks, regardless of whether their products cost money.
• The internet is increasingly geopolitically fragmented. Technical standards like TLS exist in a legal and political context that continues to evolve.

The Bigger Picture

Let's Encrypt's mission remains admirable—encrypting the entire web and making HTTPS accessible to everyone. These new requirements don't change that core goal. They simply acknowledge the reality that operating a trusted certificate authority requires navigating international law.

For developers building global applications, this is worth keeping in mind. Sanctions compliance is creeping into areas that once seemed purely technical. If you're working on projects with international scope, understanding these frameworks is becoming essential knowledge.

Bottom line: If you're a typical website owner, this change requires nothing more than acknowledging a checkbox. But it signals something larger about how the infrastructure of internet security is adapting to a more regulated, fragmented global environment.