I open websites on my iPhone in Safari, just like most of you. And that’s exactly what the latest scare story is built around: supposedly, in May they tightened certificate issuance for sanctioned companies, which means Safari will soon start complaining about Russian websites or stop opening them entirely. They even named an exact date — June 13. The panic was especially cleverly amplified by linking it to the story about the shutdown of MAKS on iPhone, which now only opens from the web version. The date came and went, and Sber, Gosuslugi, and banking apps are working as if nothing happened.
Russian websites might stop opening. Truth or fiction?
How Website Security Certificates Work on iPhone
A certificate is a digital ID for a website. When you visit a bank’s page, the browser checks that it was signed by a trusted authority, and only then shows the lock icon and a secure connection via the https protocol. If there’s no signature or it can’t be trusted, you’ll see a red warning about an insecure connection. You can still open the page, but few people will voluntarily go there. And for good reason: a real threat often hides behind that screen, as fake websites steal Apple IDs and access to iCloud.
There are fewer than a hundred trusted authorities in the world — 85, to be exact. Their list is built right into iOS, macOS, Windows, and the browsers themselves. That’s exactly why Safari on your iPhone trusts some signatures and complains about others. And this is precisely where the pain point lies for Russia.
In May, the CA/Browser Forum — the community that writes the rules for certificate authorities — explicitly added a prohibition on issuing certificates to applicants from sanctions lists into its documentation. It sounds like news, but in essence it’s just a formalization of what has been in effect since 2022. That’s when Russian government agencies, state corporations, and sanctioned companies lost the ability to legally obtain foreign signatures.
In response, Russia created a national certificate authority (NCA). It does issue certificates, and for some government resources they work. The problem is that the NCA is not part of the global chain of trust. It’s not in iOS, not in macOS, not in Safari, not in Chrome. Opening a website with such a certificate without issues is essentially only possible in the Yandex Browser or Atom. In your Safari, it will trigger that same warning. Since most iPhone owners use Safari, and Safari doesn’t recognize the Russian authority, theoretically moving all our websites to domestic signatures would indeed cut you off from the familiar internet. The key word here is “theoretically.” In practice, this transition isn’t happening, and the reasons are very down-to-earth.
Why Russian Websites Continue to Work in Safari
Sber has been under sanctions since 2022, but its certificate is brand new
The most interesting part begins when you look not at headlines but at specific websites. Open the certificate details for Sber on your Mac or iPhone. In the “issued by” field, you’ll see HARICA — the Greek certificate authority Hellenic Academic and Research Institutions CA. The certificate is fresh, issued on June 2, 2026, and valid until December. Sberbank has been under sanctions for years, yet its signature is European and completely new.
The Gosuslugi story is even more telling. Their certificate is issued by GlobalSign, one of the largest international authorities. It was issued in November 2025 and is valid until December 2026. In other words, the country’s main government portal lives happily on a foreign signature, and Safari opens it without a single question.
Gosuslugi also works just fine
How is this possible if the ban exists? Very simply. International authorities don’t scour the internet looking for violators — for them, that’s extra expense and hassle. They usually learn about a problematic client from the news and only then take action. Sanctions in this area exist on paper but are enforced very loosely. That’s why giants like Let’s Encrypt and GlobalSign still massively serve Russian websites, including government ones, which are in absolutely no hurry to switch to the NCA.
There’s also a deeper reason. Businesses need their website to open both inside and outside the country. If they switched to a domestic certificate, all external traffic would hit a red warning, and a foreign visitor would simply close the tab. Nobody wants to voluntarily cut off half their audience, so everyone delays the transition as long as possible.
What to Do if Safari Warns You About an Insecure Website
Don’t ignore warnings about dangerous websites, but don’t panic over every single one either
The practical takeaway is short: there’s no need to panic — your iPhone and Mac work just as they always have. But a couple of things are worth keeping in mind.
- First. If a government resource suddenly greets you with an insecure connection warning, don’t panic right away. It may have switched to a Russian certificate that Safari doesn’t recognize. For such cases, keep Yandex Browser or another Russian app on your device — domestic signatures open in them without any hassle.
- Second, and much more important. Don’t train yourself to click “open anyway” on every such screen. On an unfamiliar website, a red warning more often means a real threat than sanctions policy. The habit of ignoring these signals is a straight path to scammers.
The main skill in this whole story isn’t having a backup browser — it’s the ability to distinguish a real problem from informational noise. The better you understand how everything works, the less likely you are to panic over some loud headline.
