conv.

All stories
SecurityQuiet 6d · day 6

China firm briefly enabled Iran sanctions-busting toll collection at Strait of Hormuz

TrustAsia issued a security certificate to Iran's Persian Gulf Straits Authority for four days before revoking it, drawing U.S. sanctions scrutiny.

newest coverage 5d agosummary written 4d ago2 pieces Newswires

What to know

  • A Shanghai-based certificate authority briefly enabled a U.S.-sanctioned Iranian maritime authority to resume secure web operations, allowing toll collection at the Strait of Hormuz—a critical chokepoint for global oil shipments.
  • The four-day window of access exposed gaps in compliance screening for automated certificate issuance, as TrustAsia did not conduct manual vetting before issuing credentials to the sanctioned entity.
  • U.S. sanctions experts warn the incident could itself violate export control rules and signal the need for stricter compliance across the certificate issuance chain.
  • The broader concern: forced reliance on unencrypted connections leaves international shipping firms vulnerable to interception and could expose which companies are collaborating with Iran.

“The net result was that the website was more difficult to access, because most web browsers strongly encourage the use of secure HTTPS”

Alp Toker, NetBlocks CEO · Fox News ↗ · Sep 17

TrustAsia Shanghai-based internet security firmIran's Persian Gulf Straits Authority (PGSA) Sanctioned maritime authorityJeremy Paner Former OFAC official, sanctions lawyerAlp Toker NetBlocks CEO, digital security monitor

China firm briefly enabled Iran sanctions-busting toll collection at Strait of Hormuz
Fox News

How it unfolded 2 developments, newest first · click a bar or a number to jump articles

Peak 1 piece in two hours at Sep 18, 6 AM; 2 pieces over 6 days (2 articles) Sep 18, 6 AM — 1 piece · 1 article — Newswires 1Sep 18, 8 AM — quietSep 18, 10 AM — 1 piece · 1 article — Newswires 1Sep 18, 12 PM — quietSep 18, 2 PM — quietSep 18, 4 PM — quietSep 18, 6 PM — quietSep 18, 8 PM — quietSep 18, 10 PM — quietSep 19, 12 AM — quietSep 19, 2 AM — quietSep 19, 4 AM — quietSep 19, 6 AM — quietSep 19, 8 AM — quietSep 19, 10 AM — quietSep 19, 12 PM — quietSep 19, 2 PM — quietSep 19, 4 PM — quietSep 19, 6 PM — quietSep 19, 8 PM — quietSep 19, 10 PM — quietSep 20, 12 AM — quietSep 20, 2 AM — quietSep 20, 4 AM — quietSep 20, 6 AM — quietSep 20, 8 AM — quietSep 20, 10 AM — quietSep 20, 12 PM — quietSep 20, 2 PM — quietSep 20, 4 PM — quietSep 20, 6 PM — quietSep 20, 8 PM — quietSep 20, 10 PM — quietSep 21, 12 AM — quietSep 21, 2 AM — quietSep 21, 4 AM — quietSep 21, 6 AM — quietSep 21, 8 AM — quietSep 21, 10 AM — quietSep 21, 12 PM — quietSep 21, 2 PM — quietSep 21, 4 PM — quietSep 21, 6 PM — quietSep 21, 8 PM — quietSep 21, 10 PM — quietSep 22, 12 AM — quietSep 22, 2 AM — quietSep 22, 4 AM — quietSep 22, 6 AM — quietSep 22, 8 AM — quietSep 22, 10 AM — quietSep 22, 12 PM — quietSep 22, 2 PM — quietSep 22, 4 PM — quietSep 22, 6 PM — quietSep 22, 8 PM — quietSep 22, 10 PM — quietYesterday, 12 AM — quietYesterday, 2 AM — quietYesterday, 4 AM — quietYesterday, 6 AM — quietYesterday, 8 AM — quietYesterday, 10 AM — quietYesterday, 12 PM — quietYesterday, 2 PM — quietYesterday, 4 PM — quietYesterday, 6 PM — quietYesterday, 8 PM — quietYesterday, 10 PM — quietToday, 12 AM — quietToday, 2 AM — quietToday, 4 AM — quietToday, 6 AM — quietToday, 8 AM — quiet 1–2
Sep 19Sep 20Sep 21Sep 22yesterdaynow · 9:44 AM ET
  1. 1

    TrustAsia revokes certificate after four days

    The Shanghai firm revoked the web security certificate it had issued to the PGSA, though digital security experts warn the brief access enabled Tehran to operate a sanctions-busting portal and that the revocation itself may draw U.S. scrutiny.

  2. 2

    U.S. sanctions experts warn TrustAsia and urge compliance review

    Jeremy Paner, a partner at Hughes Hubbard & Reed and former OFAC official, warned TrustAsia to review its compliance program, cautioning that even limited services to sanctioned Iranian entities could trigger U.S. sanctions action.

    “before it is too late…”
    — Jeremy Paner
  3. background

    TrustAsia issues security certificate to sanctioned Iranian authority — Shanghai-based TrustAsia issued an automated domain-validated SSL/TLS certificate to the PGSA, restoring secure web access for four days and enabling the authority to collect vessel tolls and operate despite U.S. digital restrictions.

  4. background

    Iran's PGSA reports website disruption — The Persian Gulf Straits Authority announced on X that its website was disrupted, blaming "the enemy's political influence on the internet service provision systems."

  5. background

    OFAC adds Iran's Persian Gulf Straits Authority to sanctions list — The U.S. Office of Foreign Assets Control (OFAC) designated the PGSA, causing it to lose standard SSL/TLS web security certificates and making its website inaccessible through standard browsers.