HARICA: external report alleging continued issuance and refusal to revoke DV TLS certificates for domains associated with EU-sanctioned entities

This case was opened by an external reporter who alleged that HARICA issued and continued to maintain DV TLS certificates for domains that commenters associated with EU-sanctioned entities, and that HARICA declined to revoke them after receiving multiple Certificate Problem Reports. Additional commenters expanded the scope with more domains, datasets, ticket numbers, and copies of prior correspondence that they said had been sent to HARICA. HARICA stated that all certificates referenced in the bug were issued through its self-service CertManager workflow rather than its pre-validated enterprise ACME workflow, and said that in this self-service DV path identity information is neither required nor verified for certificate issuance. HARICA further said that account registration can contain fake information, that no government ID is submitted at registration time, and that sanctions screening in this workflow occurs only when a customer requests a business invoice. HARICA reiterated that its current interpretation is that revocation is not required absent further legal or regulatory direction, and said it continues to explore such direction. HARICA also said it would improve its public guides to remove ambiguity about account-registration expectations in the self-service DV flow. Mozilla stated earlier in the thread that it had not yet reached any conclusions and later reminded participants to follow Mozilla’s community participation guidelines. The bug is now closed as RESOLVED INVALID.

1. 2026-06-21 Reporters said they submitted multiple Certificate Problem Reports to HARICA regarding certificates they associated with sanctioned entities.
2. 2026-06-22 Reporter said HARICA had closed reports and declined revocation for cited DV TLS certificates.
3. 2026-07-03 HARICA publicly stated that DV certificates only validate domain control and that revocation was not required absent further legal or regulatory direction.
4. 2026-07-07 HARICA stated that the certificates in the bug were issued through its self-service CertManager workflow rather than its pre-validated enterprise ACME service.
5. 2026-07-08 HARICA said account registration in the self-service DV flow does not require ID submission, may contain fake information, and that it would improve its guides to reduce ambiguity.
6. 2026-07-08 HARICA reiterated that its current interpretation is that revocation is not required without further legal or regulatory direction and that it continues to explore such direction.

1. 2026-06-22 Duck representative — Opened the bug alleging HARICA continued issuing and refused to revoke DV TLS certificates for domains associated with sanctioned entities, and quoted HARICA’s CPR response.
2. 2026-06-22 Community commenter — Argued that HARICA needed to address the issue and referenced another Bugzilla case as similar context.
3. 2026-06-24 Silomails representative — Added a larger list of domains and sanctions references that they said had also been reported to HARICA.
4. 2026-06-24 Mozilla representative — Clarified that Mozilla had not reached any conclusions and that the bug was for fact gathering.
5. 2026-06-25 HARICA — Said HARICA was monitoring the bug and planned to respond by 2026-07-03.
6. 2026-06-26 Duck representative — Added another certificate example and asked that it be included in the investigation.
7. 2026-07-03 HARICA — Stated HARICA’s position that DV certificates only validate domain control and that revocation was not required absent further legal or regulatory direction.
8. 2026-07-03 Community commenter — Disagreed with HARICA’s position and argued that other CAs had revoked similar certificates after notification.
9. 2026-07-05 Community commenter — Submitted a larger dataset and argued that HARICA had a systemic compliance problem affecting many domains.
10. 2026-07-05 Duck representative — Submitted another dataset and said HARICA had been repeatedly notified through multiple CPR tickets.
11. 2026-07-05 Community commenter — Said HARICA had direct prior notice through an earlier supplemental CPR and attached correspondence.
12. 2026-07-05 Duck representative — Listed multiple CPR ticket numbers and said HARICA had closed them with the same response.
13. 2026-07-05 Community commenter — Argued from HARICA’s public guides that HARICA might have more applicant information than its earlier comments suggested.
14. 2026-07-06 Community commenter — Added references to Ukrainian sanctions-related sources for some of the reported domains.
15. 2026-07-07 HARICA — Explained that the reported certificates were issued through HARICA’s self-service CertManager path, not its pre-validated enterprise ACME workflow, and described when sanctions screening occurs.
16. 2026-07-07 Duck representative — Said he had escalated the matter to HARICA’s auditor and Greek authorities.
17. 2026-07-07 Community commenter — Responded that HARICA’s public guide language suggested stronger identity expectations than HARICA described.
18. 2026-07-07 Community commenter — Said HARICA’s legal review had already reached the same conclusion before HARICA’s public comments and attached prior correspondence.
19. 2026-07-08 Mozilla representative — Reminded participants to follow Mozilla’s community participation guidelines and said he would review the discussion further.
20. 2026-07-08 Silomails representative — Said a GlobalSign certificate previously cited by HARICA had since been revoked.
21. 2026-07-08 HARICA — Objected to several comments as violating Bugzilla etiquette and community guidelines.
22. 2026-07-08 HARICA — Reiterated that all certificates referenced in the bug were issued through the self-service path and that account registration does not require ID submission.
23. 2026-07-08 HARICA — Said HARICA allows applicants to register with fake information and would improve its guides to remove ambiguity.
24. 2026-07-08 HARICA — Reaffirmed that HARICA’s current interpretation is that revocation is not required without further legal or regulatory direction and that it continues to explore such direction.
25. 2026-07-08 Community commenter — Responded that HARICA’s comments still left unresolved questions about applicant information and payment-related records.
26. 2026-07-09 Community commenter — Posted a political comment unrelated to the technical handling of the case.
27. 2026-07-09 Community commenter — Argued that sanctions law applies regardless of certificate type and noted that other CAs had revoked similar certificates after notification.
28. 2026-07-09 Keigher representative — Questioned how a DV certificate could be legitimately obtained for a domain without being the legal entity behind it.