China Firm's Web Security Move Sparks Sanctions Concerns Over Iran's Strait Toll Operations

China Firm Briefly Enables Iran's Maritime Extortion Scheme

After a four-day window in which Iran's sanctioned Persian Gulf Straits Authority (PGSA) regained secure digital access, a Shanghai-based internet security firm revoked its web credentials—highlighting the complex intersection of technology, sanctions enforcement, and global maritime security. The move by TrustAsia Technologies, which issued a domain-validated certificate for pgsa.ir, sparked immediate concern among U.S. sanctions experts who warn that such services, even if automated, may breach U.S. policy.

"This is a class of vulnerability open to government exploitation, rather than a corporate breach or personal data leak," said Alp Toker, CEO of NetBlocks, referencing the shift in traffic protocols that occurred when the PGSA's site became inaccessible.

The PGSA, designated by the U.S. Treasury Department in May as part of its broader efforts to counter Iranian maritime extortion, operates a system that forces vessels transiting the Strait of Hormuz to pay fees—a scheme widely viewed as an illegal act under international law. Despite being added to OFAC's sanctions list, the PGSA was able to briefly resume secure web operations through TrustAsia's issuance of a new certificate.

Automated Certificates and Sanctions Risk

The automated nature of the certificate issuance, while seemingly routine, raises significant questions about compliance. TrustAsia, a company that bills itself as a leader in trusted digital communication, confirmed it issued a Domain Validated TLS certificate for pgsa.ir without performing checks on the entity's legal status or sanctions classification.

"DV certificates are issued through automated validation of control over the requested domain names," TrustAsia stated in an August 20 statement. "This process does not verify or assert the legal identity, affiliation, or sanctions status of the entity operating or benefiting from the domain."

However, this lack of vetting has not gone unnoticed by U.S. authorities. Former OFAC official Jeremy Paner emphasized that such actions—regardless of intent or automation—could trigger sanctions under Executive Order 13224. "Restoring the certificate is unequivocally sanctionable," he warned.

Global Implications and Compliance Failures

The incident also underscores a deeper issue in the global tech ecosystem: how Chinese certificate authorities like TrustAsia operate outside Western compliance frameworks, creating potential vulnerabilities for international digital security.

Toker noted that while TrustAsia had not been directly sanctioned by the U.S., its actions could prompt broader consequences. "This could have splintered the global chain of trust and potentially render much of the Chinese web inaccessible from the West," he said.

U.S. Treasury Secretary Scott Bessent, speaking on August 24, reinforced the government's approach toward such activities by expanding sanctions targeting nearly 60 Iran-linked individuals, entities, and vessels. While TrustAsia was not included in this latest round of penalties, the firm's actions are now under intense scrutiny.

Reputational Risk for Chinese Tech Firms

The TrustAsia case serves as a warning to Chinese tech firms operating in global markets—particularly those that may inadvertently provide services to sanctioned entities. Paner noted that,"There's always reputational risk involved in any company that decides to do business with the IRGC."

He further advised that companies should identify and audit all their existing relationships with Iranian entities to avoid potential future sanctions.

"If I were advising TrustAsia, I would at minimum immediately identify all other IRGC companies receiving services," Paner said. "This is a clear signal that U.S. enforcement may be escalating."

The Broader Sanctions Landscape

The U.S. government's approach to sanctions has increasingly shifted toward secondary liability—holding foreign entities accountable for supporting Iranian activities, even if those actions are not directly orchestrated by the U.S. itself. The recent expansion of secondary sanctions underscores this trend and signals that global technology firms must carefully navigate their operational policies.

As Iran continues to assert control over the Strait of Hormuz—a critical chokepoint for global oil supplies—any digital infrastructure supporting its maritime extortion efforts is now a point of contention in U.S. foreign policy. The fact that TrustAsia acted without clear due diligence highlights the risks for international companies that may not fully appreciate the implications of their services.

What's Next?

The revocation of the certificate by TrustAsia, which occurred on August 21, effectively ended the PGSA's secure access. However, this does not resolve the broader legal and ethical questions raised by the episode. The U.S. Treasury Department and OFAC may now initiate a more thorough review of TrustAsia's compliance practices, potentially leading to new enforcement actions.

As international scrutiny intensifies, firms that provide services to sanctioned entities—regardless of automation or oversight—may find themselves facing an uncertain future in global markets. For now, the brief period during which Iran's maritime authority could collect tolls remains a cautionary tale for tech firms and policymakers alike.