Iran’s sanctioned Persian Gulf Straits Authority (PGSA) regained secure online access for four days after a Shanghai-based internet security firm provided and then revoked its web credentials, enabling Tehran to vet vessels, collect Strait of Hormuz tolls and operate despite U.S. digital restrictions, global internet monitors said.
asserted
monitors → sanction → restrictions
TrustAsia issued an automated domain-validated certificate, a routine process that verifies control of a website domain through server checks and typically does not involve manual vetting or background checks.
asserted
that → issue → vetting
The move prompted U.S. sanctions experts, including Jeremy Paner, a partner at Hughes Hubbard & Reed, to urge TrustAsia to review its compliance program before offering further services to the IRGC-linked maritime authority — with Paner warning them to act "before it is too late."
asserted
it → prompt → them
The PGSA first said its website was disrupted Aug. 10 because of "the enemy's political influence on the internet service provision systems," according to a post on X.
NetBlocks CEO Alp Toker told Fox News Digital that the authority had lost its web security credentials after the entity was added to the U.S. Office of Foreign Assets Control (OFAC) sanctions list on May 27.
uncertain
entity → say → May
The loss of standard SSL/TLS certificates, Toker said, made the PGSA website inaccessible using standard browsers.
asserted
website → say → browsers
This forced shipping firms to use unencrypted connections that, according to Toker, could leave their data vulnerable to interception.
uncertain
that → force → interception
While no data breaches resulting from the use of these connections have been made known, and there are no known instances in which a shipping firm’s data was intercepted and used to its detriment because of the certificate expiration, Toker said the site’s inaccessibility resulted in a shift to what he described as "insecure protocols."
asserted
he → result → protocols
"The digital transparency records are authoritative on this," he said, adding that the measure forced the traffic into a format that could be readily intercepted.
"
uncertain
that → say → format
"
Toker claimed this could make it easier for authorities to read communications sent through the platform, potentially identifying shipping firms collaborating with the PGSA.
uncertain
authorities → claim → PGSA
"The net result was that the website was more difficult to access, because most web browsers strongly encourage the use of secure HTTPS," Toker said, adding that any form submissions could have been easily "eavesdropped on because they're no longer encrypted in transit."
uncertain
they → access → transit
"The mentioned issue has been resolved, and the secure domain https://pgsa.ir is now once again available for submitting requests using any browser," the PGSA said six days later on Aug. 17 and in another post shared on X.
"
asserted
PGSA → mention → X.
If the issue recurs in the future, the HTTP domain will again be temporarily available using the Firefox browser.
asserted
domain → recur → browser
Toker confirmed that Iran had turned to Shanghai-based certificate authority TrustAsia Technologies, which he said issued new digital security credentials to the PGSA despite the U.S. sanctions and restoring secure access to its website.
asserted
he → confirm → website
"Iran’s IRGC extorts vessels transiting the Strait of Hormuz through the so-called Persian Gulf Strait Authority," the Treasury Department said in May when designating the entity, adding that the PGSA "spearheads an Iranian-controlled scheme that flagrantly violates international law and U.S. sanctions."
"Anyone cooperating with the so-called strait authority may be providing support to and receiving services from the IRGC, which ultimately benefits from this attempted extortion, and may therefore be exposed to sanctions risk," the Treasury Department warned.
uncertain
Department → extort → risk
The Chinese firm bills itself as a "leading and professionally certified certification authority in China with its focus on trusted, secure and cryptographic communications in the digital world."
Its mission, it says, is to "Build trust everywhere in the digital world."
asserted
it → bill → world
"Almost all of these root authorities do business with the U.S., so they tend to comply with U.S. sanctions," Toker said.
asserted
Toker → do → sanctions
But TrustAsia, he noted, had "gone its own way, building a China-first certificate infrastructure that sidesteps the West."
asserted
that → note → West
Toker said TrustAsia had "simply gone ahead and issued Iran's PGSA with a new certificate, and Iran was once again collecting revenue from ships passing the Strait via its secure online portal."
asserted
Iran → say → portal
Paner warned that U.S. authorities would have enforcement powers over such actions.
asserted
authorities → warn → actions
"The U.S. has incredibly broad authority to impose sanctions on non-Iranian companies that provide any sorts of services to sanctioned Iranian companies," he told Fox News Digital.
asserted
he → have → companies
"Many times, that authority will be abbreviated or explained as being providers of material support to sanctioned Iranian companies.
asserted
authority → abbreviate → companies
But in fact, any level of services whatsoever could be the basis for the United States imposing sanctions against the company for providing services to Iran.
uncertain
States → impose → Iran
"
"Restoration of the certificate is unequivocally sanctionable," Paner warned.
asserted
Paner → warn → certificate
"Restoring the certificate is/was a service provided to the PGSA, which can be the basis for imposing sanctions pursuant to Executive Order 13224, as amended.
asserted
which → restore → Order
"That authority does not in any way require that the service be "knowingly" provided to the PGSA.
asserted
service → require → PGSA
In other words, the automated nature of the service is irrelevant and does not make the service any less sanctionable," the lawyer added.
asserted
lawyer → make → service
In a statement to Fox News Digital on Aug 20, a spokesperson for TrustAsia confirmed that the firm issued a "Domain Validated TLS certificate for pgsa.ir."
"Thank you for bringing this matter to our attention," the firm said before clarifying that "DV certificates are issued through automated validation of control over the requested domain names."
asserted
certificates → confirm → names
"This process does not verify or assert the legal identity, affiliation, or sanctions status of the entity operating or benefiting from the domain.
asserted
process → verify → domain
As a result, the relationship described in your inquiry was not identified during the automated issuance process."
asserted
relationship → describe → process
Following the firm's review, TrustAsia said it "added the entire pgsa.ir domain namespace to our restricted-issuance list to prevent further issuance or renewal.
asserted
it → follow → issuance
"
"We also expect to complete revocation of the existing certificate within this week," the spokesman said on Aug. 20.
asserted
spokesman → expect → Aug.
They should not be interpreted as a finding that the certificate was technically misissued, TrustAsia said.
asserted
TrustAsia → interpret → finding
Toker confirmed the TrustAsia certificate's privilege had been withdrawn on Aug. 21 at 12:15:25 UTC.
asserted
privilege → confirm → UTC
"This usually means the issuer has taken action," he said.
asserted
he → mean → action
The internet expert clarified that the revocation will gradually be coming into effect, with the firm "signaling that the PGSA certificate should no longer be trusted, and they're distributing this notice that privilege is withdrawn, usually meaning customer misuse or breached terms of use."
asserted
privilege → clarify → use
"The secure website will stop working in most browsers, unless the owners can find a certificate authority that's willing to issue a new certificate," Toker said.
asserted
Toker → stop → certificate
After reviewing TrustAsia's statement, Paner also said that OFAC would expect the company to "use the discovery as an opportunity to enhance its compliance program before it is too late."
asserted
it → review → program
The former OFAC official clarified that Iran's revenue collection in the waterway would likely draw high-level scrutiny in Washington.
"
asserted
collection → clarify → Washington
Iran's attempt to extort the world in the movement of oil through the Strait of Hormuz is of the utmost importance to OFAC, which is the agency that implements and enforces U.S. economic sanctions.
asserted
that → extort → sanctions
Because major U.S. web browsers currently recognize TrustAsia’s root certificates, American systems would have automatically trusted the sanctioned Iranian portal.
asserted
systems → recognize → portal
…and 16 more, not listed.
The Aporia
