China Firm Helped Iran Prepare Hormuz Toll Collections Before Halting Plan Amid US Warning

Iran’s sanctioned Persian Gulf Straits Authority (PGSA) restored secure online access for four days after Shanghai-based internet security company TrustAsia Technologies issued—and later revoked—web credentials, according to global internet monitors. The access allowed Tehran to vet vessels, collect Strait of Hormuz tolls and continue operating despite U.S. digital restrictions.

TrustAsia provided an automated domain-validated certificate, a standard procedure that confirms control of a website through server checks. The process generally does not include manual reviews or background investigations.

The development led U.S. sanctions specialists, including Jeremy Paner, a partner at Hughes Hubbard & Reed, to call on TrustAsia to examine its compliance program before providing additional services to the IRGC-linked maritime authority. Paner urged the company to act “before it is too late.”

The PGSA initially said its website went offline Aug. 10 because of “the enemy’s political influence on the internet service provision systems,” according to a post on X.

NetBlocks CEO Alp Toker told News Outlet that the authority lost its web security credentials after the entity was added to the U.S. Office of Foreign Assets Control (OFAC) sanctions list on May 27.

Without standard SSL/TLS certificates, the PGSA website could not be accessed through ordinary browsers, Toker said. Shipping companies were consequently pushed toward unencrypted connections that could expose their information to interception.

There have been no reported data breaches linked to those connections, nor any known cases in which a shipping company’s information was intercepted and used against it, Toker said. Still, the expired certificate prompted a shift to what he called “insecure protocols.”

“The digital transparency records are authoritative on this,” Toker said, explaining that the change routed traffic through a format that could be intercepted with relative ease.

“This is a class of vulnerability open to government exploitation, rather than a corporate breach or personal data leak.”

Toker said the weakness could allow authorities to monitor communications sent through the platform and potentially identify shipping companies working with the PGSA.

“The net result was that the website was more difficult to access, because most web browsers strongly encourage the use of secure HTTPS,” Toker said. He added that information submitted through the site could have been easily “eavesdropped on because they’re no longer encrypted in transit.”

“The mentioned issue has been resolved, and the secure domain is now once again available for submitting requests using any browser,” the PGSA said six days later, on Aug. 17, in another post on X.

“If the issue recurs in the future, the HTTP domain will again be temporarily available using the Firefox browser.”

Toker confirmed that Iran had turned to Shanghai-based certificate authority TrustAsia Technologies, which issued new digital security credentials to the PGSA despite the U.S. sanctions and restored secure access to the website.

“Iran’s IRGC extorts vessels transiting the Strait of Hormuz through the so-called Persian Gulf Strait Authority,” the Treasury Department said in May when it designated the entity. The department added that the PGSA “spearheads an Iranian-controlled scheme that flagrantly violates international law and U.S. sanctions.”

“Anyone cooperating with the so-called strait authority may be providing support to and receiving services from the IRGC, which ultimately benefits from this attempted extortion, and may therefore be exposed to sanctions risk,” the Treasury Department warned.

TrustAsia describes itself as a “leading and professionally certified certification authority in China with its focus on trusted, secure and cryptographic communications in the digital world.”

The company states that its mission is to “Build trust everywhere in the digital world.”

“Almost all of these root authorities do business with the U.S., so they tend to comply with U.S. sanctions,” Toker said.

But TrustAsia, he noted, had “gone its own way, building a China-first certificate infrastructure that sidesteps the West.”

Toker said TrustAsia had “simply gone ahead and issued Iran’s PGSA with a new certificate, and Iran was once again collecting revenue from ships passing the Strait via its secure online portal.”

Paner warned that U.S. authorities would have enforcement powers over such actions.

“The U.S. has incredibly broad authority to impose sanctions on non-Iranian companies that provide any sorts of services to sanctioned Iranian companies,” he told News Outlet.

“Many times, that authority will be abbreviated or explained as being providers of material support to sanctioned Iranian companies. But in fact, any level of services whatsoever could be the basis for the United States imposing sanctions against the company for providing services to Iran.”

“Restoration of the certificate is unequivocally sanctionable,” Paner warned.

“Restoring the certificate is/was a service provided to the PGSA, which can be the basis for imposing sanctions pursuant to Executive Order 13224, as amended.

“That authority does not in any way require that the service be ‘knowingly’ provided to the PGSA. In other words, the automated nature of the service is irrelevant and does not make the service any less sanctionable,” the lawyer added.

In a statement to News Outlet on Aug. 20, a spokesperson for TrustAsia confirmed that the firm issued a “Domain Validated TLS certificate for pgsa.ir.”

“Thank you for bringing this matter to our attention,” the firm said before clarifying that “DV certificates are issued through automated validation of control over the requested domain names.”

“This process does not verify or assert the legal identity, affiliation, or sanctions status of the entity operating or benefiting from the domain.

“As a result, the relationship described in your inquiry was not identified during the automated issuance process.” Following the firm’s review, TrustAsia said it “added the entire pgsa.ir domain namespace to our restricted-issuance list to prevent further issuance or renewal.”

“We also expect to complete revocation of the existing certificate within this week,” the spokesman said on Aug. 20.

These actions are precautionary compliance and risk-control measures. They should not be interpreted as a finding that the certificate was technically misissued, TrustAsia said.

Toker confirmed the TrustAsia certificate’s privilege had been withdrawn on Aug. 21 at 12:15:25 UTC. “This usually means the issuer has taken action,” he said.

The internet expert clarified that the revocation will gradually be coming into effect, with the firm “signaling that the PGSA certificate should no longer be trusted, and they’re distributing this notice that privilege is withdrawn, usually meaning customer misuse or breached terms of use.”

“The secure website will stop working in most browsers, unless the owners can find a certificate authority that’s willing to issue a new certificate,” Toker said.

After reviewing TrustAsia’s statement, Paner also said that OFAC would expect the company to “use the discovery as an opportunity to enhance its compliance program before it is too late.”

The former OFAC official clarified that Iran’s revenue collection in the waterway would likely draw high-level scrutiny in Washington.

“Iran’s attempt to extort the world in the movement of oil through the Strait of Hormuz is of the utmost importance to OFAC, which is the agency that implements and enforces U.S. economic sanctions.”

Because major U.S. web browsers currently recognize TrustAsia’s root certificates, American systems would have automatically trusted the sanctioned Iranian portal.

Toker claimed the Treasury Department could have found TrustAsia in violation of sanctions for providing material assistance to a blocked entity, potentially forcing tech giants such as Google and Microsoft to revoke trust in TrustAsia.

There is no evidence that this process had begun or was likely to occur.

“This could have splintered the global chain of trust and potentially render much of the Chinese web inaccessible from the West,” Toker warned.

Paner clarified that the certificates authenticate the site, boosting its credibility, and suggested TrustAsia should have weighed the risks of working with sanctioned entities.

“There’s always reputational risk involved in any company that decides to do business with the IRGC.”

“If I were advising TrustAsia, I would at minimum immediately identify all other IRGC companies receiving services.”

Paner added that this latest situation aligned with broader warnings from administration officials.

“I think this dovetails pretty nicely with Secretary Bessent’s comments about how the coming sanctions are going to be unlike any that has come prior. Sanctions require a careful balancing of the costs and the benefits.

“When it’s a Chinese tech company providing necessary services to the IRGC, I’m confident that the U.S. government is going to forego any sort of balancing in that regard.”

The United States on Aug. 24 had sanctioned nearly 60 Iran-linked individuals, entities and vessels and expanded the threat of secondary sanctions, Treasury Secretary Scott Bessent said. These did not include TrustAsia.

Bessent described the measures as part of an “economic onslaught” targeting Tehran’s global financial networks under “Operation Economic Outcast.”

A Chinese Embassy spokesperson also said in a statement: “I am not aware of the specifics you mentioned. I have no information to provide.”

News Outlet reached out to the U.S. Department of the Treasury and the White House for comment.