Access to Websites from Russia and SSL Certificates.

Mozilla is a founding member of ccadb.org and its trust roots www.mozilla.org/about/governance/policies/security-group/certs/policy (esp. see chapter 4. "Common CA Database") are bound by the programme inclusion, see wiki.mozilla.org/CA for the outline of Mozilla's CA Certificate Program and Mozilla Root Store Policy. This is basically what NSS ships with, the networking dependency that e.g. Firefox uses for relying on the published certificate bundle by default. The trusted roots have their own module activity, and the discussions can be followed and are archived at: * Mozilla CA: https://groups.google.com/a/mozilla.org/g/dev-security-policy * Linux Software Foundation CCADB: https://groups.google.com/a/ccadb.org/g/public Mozilla is also the pioneer of Let's Encrypt isrg.org that issues trusted certificates to domains without any regional restriction per se — only by being a U.S. subject it has to abide by laws esp. on exporting cryptographic material: community.letsencrypt.org/t/certificates-for-us-sanctioned-countries/1223 — so subjects that are not on the sanctions list can still request certificates. As for the organizations that won't be eligible to apply for such U.S.–based cryptographic content, I'm pretty sure there are still friendly regimes that have their own roots trusted (e.g. CNNIC or BJCA) so these can be the next provider of such services. Hopefully it won't end up with similar attempts: [["Certificate cannot be trusted" warning in Kazakhstan]] — that gives some insight into the course of action what happens if a regime tries to mount its roots to effectively be able to MITM all the communications as a result.