Trusting Russian Root Certificates and Monitoring Domestic CT Logs

The article examines risks associated with installing Russian root certificates issued by the Ministry of Digital Development. It explains how these certificates, when trusted, enable potential MitM attacks through TSPU infrastructure by allowing on-the-fly issuance of fraudulent certificates for foreign domains. Yandex Browser stands out by enforcing Certificate Transparency checks for domestic certificates, unlike other browsers that disable CT validation in the presence of added roots. Three primary domestic CT logs are maintained by Yandex, VK, and the Ministry, with log lists updated annually. A Python script is provided to query these logs directly and verify SCT inclusion for any certificate. The piece also notes limitations of existing web monitors such as ct.tlscc.ru when dealing with newer log endpoints.

HabrAugust 23, 2026Translated from Russian

Read at source

The discussion around trust in Russian root certificates issued by the Ministry of Digital Development and Communications has intensified following recent issues with GOST certificates on Gosuslugi. Users are weighing the security implications of adding these roots to system stores, browser profiles, or relying on Yandex Browser where they are pre-installed.

Root certificates themselves do not compromise systems, yet placing them in trusted stores creates a pathway for traffic interception. Entities with access to network flows via the TSPU system can issue intermediate certificates signed by the Russian root and perform real-time MitM attacks against sites such as gmail.com or telegram.org.

Defensive measures remain limited. One approach involves isolating the Russian roots to a dedicated browser profile used only for domestic sites that require them. Advanced configurations can further restrict the roots to specific domains such as *.ru.

Certificate Transparency as a Mitigation

Certificate Transparency logs record every issued certificate in an append-only structure, embedding proof of inclusion inside the certificate. Yandex Browser refuses certificates lacking a valid SCT from approved logs, significantly raising the bar for undetected MitM operations and leaving forensic traces.

Other browsers automatically disable CT verification for chains anchored to manually added roots, treating them as corporate environments. This behavior reduces visibility into potential abuse of Russian intermediates.

Domestic CT Logs

Three primary logs are recognized by Yandex:

Yandex Agate Log (2026 and 2027 instances)
VK NCA Log (2026 and 2027 instances)
Ministry of Digital Development and Communications Log (2026 and 2027 instances)

Log endpoints rotate yearly, and the authoritative list is published at browser-resources.s3.yandex.net/ctlog/ctlog.json.

Verification Tools

Public monitors such as ct.tlscc.ru have shown gaps in coverage for newer log addresses and certain active certificates. A Python utility was developed to fetch the current log list, parse embedded SCTs, reconstruct precertificates, and query each domestic log via the standard CT HTTP API for inclusion proofs.

Yandex Browser Certificate Transparency VK NCA Log

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Policy & Regulation

Policy & Regulation

Russian Minister Proposes Blocking All SIM Cards Linked to Fraudsters Banned in MAX Messenger

The head of Russia's Ministry of Digital Development, Maksut Shadaev, has suggested extending account bans in the MAX messenger to a broader set of mobile restrictions. Under the proposal, operators would be required to disconnect not only the number used in a fraudulent account but also any other SIM cards belonging to the same individual. The measure would also introduce a cooling-off period preventing the person from registering new numbers after a ban. Officials aim to make it significantly harder for scammers to resume operations following enforcement actions. Key implementation details, including how ownership and involvement in fraud will be verified, remain unspecified in the initial statement. The initiative specifically targets fraud prevention and does not apply to every account suspension in the messenger.

AntiMalwareOct 29, 2026Translated from Russian

Policy & Regulation

Russia Ready to Disclose Source Code of Social Networks, Messengers and AI Models

Russian Minister of Digital Development Maksut Shadaev announced that the country is prepared to open the source code of its domestic social networks, messengers, and video services to international partners. Shadaev stated that Russia will show the internal structure of these platforms and allow joint modification of algorithms. The proposal was presented at the Platform of Sovereign Development exhibition and reported by TASS. He contrasted Western IT products, described as opaque black boxes, with Russia's new approach of transparency to avoid what he called digital colonialism. The same offer extends to Russian foundational AI models, which could be adapted to foreign legislation, cultural requirements, and security standards. No specific products, repository links, timelines, or licensing terms were provided during the speech.

AntiMalwareOct 29, 2026Translated from Russian

Policy & Regulation

Russia Mulls Mandatory Two-Week IMEI Registration for Foreign Smartphones via Gosuslugi

Russian authorities are discussing a new rule requiring owners of smartphones imported without customs clearance or purchased abroad to register the devices through the Gosuslugi portal within two weeks. Failure to register would result in the device being blocked from Russian mobile networks. The Ministry of Digital Development is preparing the requirements, which remain under discussion with possible changes to timelines and details. Devices already operating in Russia before April 2027 would be exempt and continue working without restrictions. Officially imported equipment would be added to the registry automatically. The measure is expected to significantly impact gray-market sellers, potentially forcing up to 70 percent of them out of the market and driving price increases of up to 40 percent for some models.

AntiMalwareOct 29, 2026Translated from Russian