What is the Let's Encrypt Subscriber Agreement?

It is the user contract that each subscriber implicitly accepts when using the service. Version 1.7, effective June 3, 2025, adds a clause of compliance with US economic sanctions.

Am I affected if my site is hosted in Switzerland?

If you are a non-sanctioned Swiss entity, no. But this news illustrates the jurisdictional risk of American providers you might use elsewhere.

Can I still use Let's Encrypt for a site targeting an international audience?

Yes, as long as you are not yourself subject to OFAC sanctions. The certificate remains technically functional for visitors worldwide.

What free alternative to Let's Encrypt do you recommend?

ZeroSSL and BuyPass Go offer free tiers, but with less mature technical integration. For critical professional use, consider paid certification as a supplement.

Does this measure affect existing automatic renewals?

Already issued certificates continue to function until expiration, but renewals are blocked for affected entities. No mass revocation mechanism has been announced.

How do I check if my technical provider is subject to US sanctions?

Consult the terms of service, the applicable jurisdiction clause, and search for mentions of OFAC compliance or US export control regulations.

Let's Encrypt: When US Sanctions Upend SSL

A free, universal SSL certificate — that was Let's Encrypt's promise. Then on June 3, 2025, version 1.7 of the Subscriber Agreement took effect. Behind this version change lies a brutal geopolitical reality: developers in Iran, Cuba, Syria, North Korea, and certain Ukrainian regions have officially lost access to the web's most popular certificate authority.Let's Encrypt - US Sanctions Enter the Contract, a technical news story that conceals a far broader tension between digital infrastructure and international regulations.

ISRG Toughens Its Contract: Understanding Version 1.7

The Internet Security Research Group, the nonprofit organization operating Let's Encrypt, published a major update to its terms of use in late May 2025. This revision appears to be entirely non-technical: no new encryption algorithm, no additional hardware requirements. Yet its Article 6.1.2 radically changes the situation.

The text now requires subscribers not to appear on any US economic sanctions lists. More specifically, entities targeted by the US Treasury's Office of Foreign Assets Control (OFAC) are automatically excluded from the service. This clause, absent from previous contract versions, transforms Let's Encrypt from a technically neutral service into a tool subject to US economic jurisdiction.

Which Territories Are Directly Affected?

The list of countries and regions covered by this exclusion is not exhaustive in the contract itself, but it refers to OFAC sanctions programs. In practice, this concerns:

Iran and Iranian entities
North Korea
Syria
Crimea, Donetsk, and Luhansk (Ukrainian regions annexed or controlled by Russia)
Cuba, under certain sectoral conditions
Any entity placed on the Specially Designated Nationals (SDN) list

Legal pro tip: a sanctions compliance clause is not mere formality. By accepting it, the user guarantees they are not affected by these restrictions. False declaration = potential contractual breach.

Why Let's Encrypt Bows to US Legislation

ISRG is an American organization, domiciled in California. This legal nationality directly exposes it to federal legislation, including that related to export controls and economic sanctions. The Electronic Frontier Foundation, despite being a historical defender of the project, could not influence this direction: the legal risk for the organization was too high.

But beyond direct criminal threat, there is an infrastructure issue. Let's Encrypt depends on partnerships with cloud providers, domain name registries, and content delivery networks that are predominantly American or themselves subject to US jurisdiction. Non-compliance could have caused a supply chain rupture far more damaging than losing part of its user base.

This situation illustrates a structural tension of the modern web: trust infrastructure (PKI, DNS, CDN) relies heavily on actors subject to US law, even when their mission claims to be global and neutral.Web Agency Geneva | Studio Dahu — Design & SEO

The Paradox of a Universal HTTPS Made Selective

Launched in 2015, Let's Encrypt aimed to democratize TLS encryption by removing financial and technical barriers. With over 400 million secured sites, this mission has broadly succeeded. But the service's free-of-charge model masked a legal dependency that few web actors took into account.

The paradox is cruel: a project born to fight mass surveillance and unequal access to security finds itself instrumentalized by a state regulatory mechanism. This is not a deliberate drift by ISRG, but the consequence of an ecosystem where technical sovereignty remains predominantly American.

Concrete Consequences for Developers and Websites

Imagine a development team in Tehran maintaining a functional e-commerce site for three years. The Let's Encrypt certificate expires in fourteen days. Automatic renewal fails silently. The site switches to unsecured HTTP, browsers display the "Not Secure" warning, transactions are interrupted, search rankings plummet. This situation, entirely real for some actors, remains invisible to the majority of web professionals established in unaffected jurisdictions.

Technical granularity poses a problem. Sanctions do not always target an entire country but sometimes specific entities, business sectors, or even individuals. Yet an SSL certificate is tied to a domain name, not to an identified legal entity. How does Let's Encrypt distinguish a generalist Iranian site from a site belonging to a specifically sanctioned entity? The service's automation, its technical strong point, becomes here a legal handicap.

Do Technical Alternatives Exist?

Several paths theoretically allow circumventing this restriction, each with its own limitations:

ZeroSSL: commercial certificate authority with a free tier, but less robust infrastructure and less integrated with automation tools
BuyPass Go: Nordic alternative with a free offering, little known outside advanced technical circles
Self-signed certificates: troubleshooting solution only, unacceptable for a public production site
National certificate authorities: some exist (Iran, Russia), but their recognition by Western browsers is partial or nonexistent
Migration to a non-sanctioned hosting provider: often illusory, as most global cloud infrastructures apply the same restrictions

In practice, no free alternative reproduces Let's Encrypt's integration ecosystem. The cost of migration, technical and financial, weighs disproportionately on the least resourced actors.

Securing Your Site: Lessons for Web Professionals

This news directly concerns technical teams and digital decision-makers, even those established in Switzerland or Europe. It reveals three strategic lessons applicable to any web infrastructure.

Diversify Critical Dependencies

Concentration on a single certificate provider, even if free and reputable, constitutes an operational risk. A dual certification policy — Let's Encrypt for routine automatic renewal, ZeroSSL or BuyPass as backup — reduces exposure. This redundancy has a maintenance cost, but proves essential for high-criticality services.Custom Development Geneva | Web Agency Studio Dahu

Monitor Contractual Evolutions

Terms of use for infrastructure services constantly evolve. Let's Encrypt version 1.7 was published on May 20, 2025, with an effective date of June 3. This two-week period, standard in the industry, did not allow for massive adoption of the new version: most automatic renewals switched silently. An active legal monitoring process, even minimal, would have allowed anticipation of this transition.

Evaluate Your Providers' Jurisdiction

Choosing a technical provider can no longer be limited to performance and cost criteria. Legal nationality, data processing agreements, compliance with extraterritorial regulations (CLOUD Act, OFAC sanctions) influence a service's operational resilience. For a Swiss company handling sensitive data, this analysis becomes prerequisite to any architecture decision.

MCP Tool: Manage Your Website Through AI

Let's Encrypt - US Sanctions Enter the Contract: Toward What Web Regulation?

This Let's Encrypt affair is not an isolated incident. It fits into a long-term trend: technical fragmentation of the web along geopolitical blocs. Parallel national PKI initiatives are already observed in Russia, China, and growing distrust of ICANN authority under American influence.

The risk for web professionals is that of a siloed Internet, where technical trust becomes political. An SSL certificate recognized in one country might not be in another. Browsers, currently aligned on common root programs, could diverge in their acceptance policy. This technical balkanization would threaten the fundamental interoperability that has made the web protocol strong.

Faced with this evolution, organizations must anticipate. Digital sovereignty, an often overused term, finds here a concrete translation: capacity to operate trust services independently of diplomatic fluctuations. For European and Swiss actors, this could involve supporting alternative certification initiatives, proactive European Commission regulation on certificate authority recognition, or transnational technical partnerships less dependent on the American framework.

Test Your Site's SEO for Free

Conclusion: Beyond the Certificate, Web Governance

The 1.7 revision of Let's Encrypt's Subscriber Agreement reminds us of a truth often obscured by technical abstraction: web infrastructure is governed, regulated, politicized. No protocol, however open, entirely escapes the legal framework in which it operates. For developers, sysadmins, IT decision-makers, this news is an invitation to regain awareness of the hidden dependencies in their architectures.

A site's security is no longer measured solely by encryption robustness or certificate freshness. It also depends on providers' jurisdictional stability, critical dependency redundancy, and the organization's capacity to adapt its infrastructure to geopolitical evolutions. In a context of growing international tensions, these skills, half-technical half-strategic, will become differentiating for the most advanced teams.