China firm gave Iran lifeline to collect Hormuz tolls before pulling plug amid US warning

Irans sanctioned Persian Gulf Straits Authority (PGSA) regained secure online access for four days after a Shanghai-based internet security firm provided and then revoked its web credentials, enabling to vet vessels, collect Strait of Hormuz tolls and operate despite U.S. digital restrictions, global internet monitors said.

TrustAsia issued an automated domain-validated certificate, a routine process that verifies control of a website domain through server checks and typically does not involve manual vetting or background checks.

The move prompted U.S. sanctions experts, including Jeremy Paner, a partner at Hughes Hubbard & Reed, to urge TrustAsia to review its compliance program before offering further services to the IRGC-linked maritime authority — with Paner warning them to act "before it is too late."

The PGSA first said its website was disrupted Aug. 10 because of "the enemy's political influence on the internet service provision systems," according to a post on X.

NetBlocks CEO Alp Toker told Fox News Digital that the authority had lost its web security credentials after the entity was added to the U.S. Office of Foreign Assets Control (OFAC) sanctions list on May 27.

The loss of standard SSL/TLS certificates, Toker said, made the PGSA website inaccessible using standard browsers. This forced shipping firms to use unencrypted connections that, according to Toker, could leave their data vulnerable to interception.

While no data breaches resulting from the use of these connections have been made known, and there are no known instances in which a shipping firms data was intercepted and used to its detriment because of the certificate expiration, Toker said the sites inaccessibility resulted in a shift to what he described as "insecure protocols."

"The digital transparency records are authoritative on this," he said, adding that the measure forced the traffic into a format that could be readily intercepted.

"This is a class of vulnerability open to government exploitation, rather than a corporate breach or personal data leak."

Toker claimed this could make it easier for authorities to read communications sent through the platform, potentially identifying shipping firms collaborating with the PGSA.

"The net result was that the website was more difficult to access, because most web browsers strongly encourage the use of secure HTTPS," Toker said, adding that any form submissions could have been easily "eavesdropped on because they're no longer encrypted in transit."

"The mentioned issue has been resolved, and the secure domain https://pgsa.ir is now once again available for submitting requests using any browser," the PGSA said six days later on Aug. 17 and in another post shared on X.

"If the issue recurs in the future, the HTTP domain will again be temporarily available using the Firefox browser."

Toker confirmed that Iran had turned to certificate authority TrustAsia Technologies, which he said issued new digital security credentials to the PGSA despite the U.S. sanctions, restoring secure access to its website. 

"Irans IRGC extorts vessels transiting the Strait of Hormuz through the so-called Persian Gulf Strait Authority," the Treasury Department said in May when designating the entity, adding that the PGSA "spearheads an Iranian-controlled scheme that flagrantly violates international law and U.S.