Russian Bank Websites Flagged as Unsafe by Major International Browsers Amid SSL Certificate Revocations

Several major Russian banks have encountered significant access disruptions on popular international web browsers such as Google Chrome, Mozilla Firefox, Apple Safari, and Microsoft Edge. This disruption arises from the revocation of their TLS/SSL security certificates by foreign certification authorities, causing browsers to label these sites as "not secure".

Impact on Market Access and Browser Security Warnings

Leading banks including Sberbank, VTB, Alfa-Bank, Rosselkhozbank, Promsvyazbank, Uralsib, and Bank Saint Petersburg have been affected. Attempts to visit their official websites on these browsers trigger warnings that the connection is unsecured. Users must manually bypass these alerts to proceed, which poses challenges for routine digital banking operations and online transactions.

"Browsers warn users that these connections are unsecured, requiring manual confirmation to continue browsing the affected banking sites."

Interestingly, not all Russian banking websites are impacted equally. For example, the website of T-Bank remains accessible without warnings on Chrome. Furthermore, at times, the Sberbank site has opened on some international browsers with a visible 'not secure' label in the address bar.

Underlying Cause: Revoked TLS/SSL Certificates and Shift to Domestic Alternatives

The root cause stems from foreign certificate authorities, including the Japanese CA GlobalSign, beginning to revoke certificates for Russian domains as early as mid-June. This move aligns with sanctions imposed by Western governments following Russia's invasion of Ukraine. The EU’s 21st sanctions package, adopted in late July 2026, further extended restrictions on many Russian financial institutions.

TLS/SSL certificates serve as digital passports that verify the authenticity of websites and encrypt data traffic to ensure privacy and security. With international authorities withdrawing these certificates, affected Russian websites are transitioning towards domestic security certificates that are not recognized by browsers developed outside Russia.

This shift has had an immediate market impact, as global browsers reject these domestic certificates, leading to the blocking or flagging of affected websites.

Domestic Browser Solutions Gain Traction

In contrast, Russian-based browsers, particularly Yandex Browser, continue to support these domestic certificates and therefore provide seamless access to the impacted banking websites. Yandex Browser, administered within Russia and integrated with local certification authorities, remains the most widely used browser in the Russian market.

Following these developments, increased promotion of Yandex Browser has been observed, including integration into user menus on VKontakte, Russia’s leading social network, highlighting a strategic push to consolidate internet access within domestic infrastructure.

Privacy and Security Considerations

While Yandex Browser’s support for domestic certificates resolves access issues, it has raised concerns about data privacy. IT and cybersecurity experts point out that the browser’s user agreement allows for extensive data collection, including personal information, browsing habits, geographic location, social interactions, and other sensitive data.

Yandex’s privacy policy permits the sharing of such information with third parties to comply with legal requirements, which may pose additional privacy risks for users relying on this browser for critical financial interactions.

Market participants, including financial institutions and technology providers, are closely monitoring the evolving landscape as browser compatibility and security standards continue to be challenged by geopolitical factors and sanctions dynamics.

The ongoing certification revocations and browser warnings represent an emerging risk factor for digital banking operations in Russia, potentially affecting user confidence and transactional volumes across affected platforms.