DigiCert: Certificates issued for sanctioned entities

DigiCert opened this bug to disclose a sanctions-compliance incident involving three DV certificates issued to domains associated with entities on sanctions or denied-party lists. In its preliminary report, DigiCert said a third party submitted reports identifying the certificates, that two had already been revoked during internal sanctions reviews, and that the third was revoked after the follow-up report. DigiCert stated that issuance for the affected domains was halted by adding the domains to its blocklist. The report cites TLS Baseline Requirements section 9.15 and DigiCert Public Trust CP/CPS section 4.1.1. The bug remains assigned to DigiCert and the investigation was described as continuing in the preliminary report.

1. 2025-11-20 Two DV certificates for ylfelectronics.com were issued.
2. 2025-12-18 A DV certificate for api.iraytek.com was issued.
3. 2026-07-02 A CPR was received for ylfelectronics.com, both certificates were revoked, and the domain was added to the blocklist.
4. 2026-10-03 A follow-up CPR identified api.iraytek.com.
5. 2026-10-05 The api.iraytek.com certificate was revoked.

1. 2026-10-06 DigiCert — DigiCert filed a preliminary incident report saying a third party reported three DV certificates issued to sanctioned-entity domains, two had already been revoked, and the third was revoked.
2. 2026-10-17 DigiCert — DigiCert attached a sanctions-entities dossier CSV and then posted a full incident report with timeline, impact, and root-cause analysis.