TrustAsia gave Iran's Hormuz toll authority four days of secure web access before pulling the certificate

Iran's sanctioned Persian Gulf Straits Authority regained secure online operations for four days after Shanghai-based TrustAsia Technologies issued it a domain-validated TLS certificate, restoring the portal that shipping firms use to transit the Strait of Hormuz and pay the authority's tolls. NetBlocks CEO Alp Toker confirmed the certificate was revoked on Aug. 21 at 12:15:25 UTC, roughly four days after PGSA announced on X that the issue had been resolved.

The sequence matters for shipping operators with exposure to Hormuz throughput. PGSA lost its web security credentials after the U.S. Office of Foreign Assets Control added it to the sanctions list on May 27. The Treasury Department said then that PGSA "spearheads an Iranian-controlled scheme that flagrantly violates international law and U.S. sanctions" and warned that anyone cooperating with the authority could face sanctions exposure. The certificate loss pushed shipping firms toward unencrypted connections. Toker told Fox News Digital that those unencrypted connections moved traffic into a format that could be "readily intercepted," representing, in his words, "a class of vulnerability open to government exploitation, rather than a corporate breach or personal data leak." No data breach or interception of a shipping firm's data has been reported.

The certificate gap and TrustAsia's response

PGSA posted to X on Aug. 10 that its website had been disrupted by what it called "the enemy's political influence on the internet service provision systems." TrustAsia, which describes itself as a "leading and professionally certified certification authority in China," issued a DV certificate through an automated process that, by its own description, "does not verify or assert the legal identity, affiliation, or sanctions status of the entity." In an Aug. 20 statement, TrustAsia confirmed the issuance, said it had added the entire pgsa.ir domain namespace to its restricted-issuance list, and expected to complete revocation within the week.

Sanctions exposure and what comes next

Jeremy Paner, a partner at Hughes Hubbard & Reed and former OFAC official, told Fox News Digital that "restoration of the certificate is unequivocally sanctionable" under Executive Order 13224, and that the automated nature of the issuance is "irrelevant and does not make the service any less sanctionable." He urged TrustAsia to use the discovery to enhance its compliance program "before it is too late." Toker added that because major U.S. web browsers currently recognize TrustAsia's root certificates, American systems automatically trusted the PGSA portal while the certificate was active. Had Treasury moved against TrustAsia, Toker said, it could potentially have forced Google and Microsoft to revoke trust in TrustAsia root certificates, which he warned could "splinter the global chain of trust and potentially render much of the Chinese web inaccessible from the West." No evidence has emerged that Treasury started that process.

The Aug. 24 U.S. sanctions package, described by Treasury Secretary Scott Bessent as an "economic onslaught" under "Operation Economic Outcast," sanctioned nearly 60 Iran-linked individuals, entities, and vessels. TrustAsia was not among them. What to watch: whether OFAC opens a formal review of TrustAsia's compliance program and whether any other certificate authority issues new credentials to pgsa.ir.