Data snapshot: June 15, 2026 · ~165,000 .ru domains with valid certificates
GlobalSign, one of the largest commercial certificate authorities in the world, has started revoking SSL certificates for Russian companies. The reason is new rules from the CA/Browser Forum, a group that sets standards for certificates on the web. These rules require certificate authorities to follow sanctions restrictions. GlobalSign has now decided that it cannot continue issuing certificates to Russian organizations under these rules.
This matters because SSL certificates are what make a website show as secure in a browser. Without a valid certificate, visitors to a website will see a warning saying the site is unsafe. Some browsers will block access entirely. For businesses and services in Russia, this is a serious problem.
We looked at our domain and web scrape data at IPinfo to understand how big this impact could be.
How common is GlobalSign in Russia compared to the rest of the world?
This is the most important number to understand.
Globally, GlobalSign issues certificates for about 1% of all websites. But for Russian websites with the .ru domain, GlobalSign covers around 13.4%. That means GlobalSign is roughly 13 times more important to Russia than it is to the rest of the internet.
For comparison, Let’s Encrypt, which is a free and widely used certificate service, covers about 74% of .ru websites. Google Trust Services covers about 7.4%.
The Russian government has its own certificate authority run by the Ministry of Digital Development. As of June 2026, it covers 17 websites in our dataset. That is not a typo. The state alternative is effectively not being used.
What has been happening with GlobalSign in Russia over time?
Looking at our data going back to early 2025, GlobalSign’s presence in Russian websites actually grew for most of the year. It peaked in October 2025, when it was covering around 30,000 .ru domains in our dataset. Since then it has been declining. By June 2026 it was down to about 22,000 domains, a drop of roughly 27%.
This timeline matches when the new CA/Browser Forum rules started being discussed and enforced. It looks like some certificates were already being moved or not renewed before the formal revocation announcement.
Who else has already pulled out of Russia?
GoDaddy is one of the largest certificate providers in the world, covering about 20% of all websites globally. In Russia, it has almost zero presence. This suggests GoDaddy may have already stopped serving Russian customers before this current wave, quietly and without much public attention.
What does this mean for the Russian internet?
The short version is that a large share of Russian commercial websites depended on a foreign certificate authority that is now leaving. The free alternatives like Let’s Encrypt are available, but they require website operators to make active changes. For small businesses or organizations with older systems, this is not always easy.
The state-issued certificates are free, but they are not recognized by major browsers like Chrome, Firefox, or Safari. That means switching to a state certificate does not actually fix the problem for users outside Russia. For users inside Russia, it would work only if Russian browsers or operating systems are configured to trust those certificates separately.
Certificate Pinning is another problem mentioned by experts. Some mobile apps lock themselves to a specific certificate. If that certificate is revoked, the app stops working until the developer releases an update. For any Russian app using a GlobalSign certificate, this could mean sudden service outages that require a software update to fix.
The estimate in recent news reports is that 15,000 to 20,000 second-level .ru domains will be affected directly. Our data shows GlobalSign covering over 22,000 .ru domains as of June 2026, which is consistent with those estimates.
Data source
This analysis is based on web crawl and certificate data collected by IPinfo. The data covers hundreds of thousands of .ru domains and millions of domains globally. The snapshot used here is from June 15, 2026.
