Russian bank website not opening because of certificates: what to do on a computer, a phone and abroad

On October 26, RBC reported on a letter from the Association of Banks of Russia to Digital Development Minister Maksut Shadaev: the banks are asking to make the installation of Russian certificates on smartphones mandatory. RBC’s article itself is behind a paywall; vc.ru and Kod.ru summarized it. According to the association’s figures cited by Kod.ru, every second bank has received customer complaints over revoked certificates.

So if your bank’s website won’t open and the browser says “Your connection is not private,” you’re far from alone. You can get in within a couple of minutes, and there is a separate section below for those who are abroad.

Why a Russian bank’s website won’t open: what happened to the certificates

A certificate is a website’s electronic passport. A browser lets you onto a site without warnings only if the passport was issued by an authority on its list of trusted ones. In the summer of 2026, foreign authorities began revoking these passports from Russian websites.

• June 13 and 18. Two waves of revocations by the GlobalSign authority. According to RBC, the second wave covered about 310 domains of 44 companies, Gazprombank among them.
• August 3. According to Rossiyskaya Gazeta, more than two hundred certificates of Russian banks were revoked within a single minute. That evening, RBC reported that VTB’s website had stopped opening in Chrome and Safari, and its correspondent confirmed that the websites of Sberbank, Alfa-Bank, Rosselkhozbank, Uralsib, PSB and Bank Saint Petersburg would not open in foreign browsers either.
• After that, banks moved en masse to certificates from the Ministry of Digital Development’s National Certification Authority (NUC). The ministry’s certificates have been in use since 2022, but Chrome, Safari, Edge and Firefox don’t recognize them. And, as Kod.ru wrote on September 1, citing Kommersant, they will not become trusted in foreign browsers.

Hence “Your connection is not private”: the website is genuine, the browser simply doesn’t know who issued its passport.

Our October 26, 2026 check: which bank uses which certificate

On October 26, we requested the certificates of major banks’ websites from our server abroad, and for six of them also through Globalping probes, an open network of measurement points, including probes in Russia. The Russian probes got the same certificates: they don’t depend on the visitor’s country.

Of the 15 addresses of banks and DOM.RF that responded to our server, 13 run on the ministry’s certificates. Raiffeisenbank’s website did not respond to our server, so we checked its certificate through Globalping probes. Certificates change without notice, so the table is a snapshot of one day: Gazprombank, for example, got its current TrustAsia certificate on October 2.

The quickest way: Yandex Browser

The Ministry of Digital Development puts it plainly: “the Russian security certificate is already built into Yandex Browser, so its users experience no inconvenience” (Interfax, August 7). In August, VTB and Alfa-Bank gave the same advice, and on October 26 Yandex repeated it in a comment to iPhones.ru.

You don’t need to install anything. Download Yandex Browser (this is our affiliate link), open your bank’s website in it, and there will be no warning. There is no need to delete your usual browser: you can keep Yandex Browser just for banks and government sites. On a phone it works the same way.

How to install the ministry’s certificates on a computer and a phone

If you want to stay in your own browser, you will have to install the certificates yourself. The official instructions are on Gosuslugi, Russia’s government services portal, at gosuslugi.ru/crt, with separate pages for Windows, macOS, Linux, Android and iOS. You install three certificates: the root Russian Trusted Root CA and two issuing ones, Russian Trusted Sub CA and Russian Trusted Sub CA 2024. Gosuslugi says it takes 5–15 minutes. We ourselves recommend Yandex Browser, and the certificates only if you can’t do without your own browser.

• iPhone and iPad. Open the instructions in Safari and install the profile right after downloading it, otherwise it deletes itself. The last step is easy to miss: Settings → General → About → Certificate Trust Settings, turn on Russian Trusted Root CA. It matters for both Safari and Chrome: according to the Chromium documentation, Chrome for iOS checks certificates with Apple’s system tools.
• Android. Xiaomi, Samsung, Huawei and other phones have their own menu items, and Gosuslugi has separate instructions for them. It also warns that during installation the system will show something like “The privacy of your data will be compromised.” You can check the result on the User tab of the certificate list: there should be three entries. After that, Gosuslugi recommends clearing your browser’s cache.
• Windows and macOS. The certificates go into the system store, and Chrome and Edge take them from there. Firefox and Opera have their own store: add the certificates there separately or just open the bank’s website in Yandex Browser.

What a root certificate is, what you risk by adding one and how to remove it later is covered in our explainer “Your connection is not private” on the websites of Sberbank, VTB and Alfa-Bank.

What the banks propose: certificates on every smartphone

“Browser warnings about an insecure connection when logging in to bank websites reduce users’ trust in credit institutions’ web resources,” explained Bulat Anderzhanov, director of the association’s strategic development department (Kod.ru). Back on October 22, at a meeting with the Bank of Russia’s financial technology department, the association, citing banks, said that “customers face difficulties installing certificates.” According to vc.ru’s and Kod.ru’s summaries of the letter, the banks propose to:

• install NUC certificates on smartphones when apps are installed or updated;
• build a convenient installer for Windows and Linux and preinstall the certificates in Russian operating systems;
• require manufacturers of computers, smartphones and other devices to install the certificates at the factory;
• simplify issuing certificates, for example “with a single button” on Gosuslugi.

The Ministry of Digital Development confirmed it received the letter and said it is already working with the banks on explaining NUC certificates to people. No decision has been made yet. According to Kod.ru, the association is preparing its next letter, about access to Russian websites from abroad, for the Bank of Russia.

If you are abroad: “You can’t log in to SberBank Online in this browser”

For people who don’t live in Russia, a second problem is added to the certificate. On October 26, we requested online.sberbank.ru through Globalping probes. The website gave the probe in Russia the normal redirect to the login page. But to the probes in Germany, Georgia, Kazakhstan and Türkiye, including a home network in Tbilisi, it returned a short page (in Russian): “You can’t log in to SberBank Online in this browser. Please try another browser. If that doesn’t work, call us at 900 or at +7 495 500-55-50 if you are abroad.”

It looks like the browser has nothing to do with it: all the probes run the same program, not a browser, and the response changed only with the country of the address. Through the Liberum VPN Russian location, the website answered the same way that day as it does in Russia, with a redirect to the login page. The certificate was still the ministry’s, so abroad you need both at once: a browser that trusts the ministry’s certificates and a Russian address.

This has happened before. In July 2026, in response to complaints from customers abroad, T-Bank’s account on X advised iPhone users to “switch to a Russian IP address.” With a VPN, though, the bank’s app asked users to “turn off the VPN,” and the account replied that this was “not yet a final solution” (vc.ru, July 17).

How to get a Russian IP: a free week

You can try a Russian address for free: the Liberum VPN trial lasts 7 days, and you don’t need a card. Go to the Liberum VPS bot, turn on the free trial, choose the 🇷🇺 Россия (“Russia”) location, paste the subscription link you get into a client app (Happ works), turn on the connection and open your bank’s website in Yandex Browser. The location’s address is shared: other customers of the service go online through it too.

Use the website in a browser, not the bank’s app: the app can check whether a VPN is on, while a website in a browser usually sees only the address. Since April 2026, some Russian services have partly restricted access with a VPN turned on (ComNews, citing TASS), so we can’t promise you’ll get into your account: we didn’t test logging in. How this kind of access works is explained on our page a Russian IP for websites that turn away foreign addresses.

What not to do

• Clicking Advanced → Proceed to the site and entering your password. The button checks nothing; it only hides the warning. The same error appears when a site is genuinely being spoofed, so we don’t recommend entering passwords and codes on such a page.
• Installing certificates from emails, chats or other websites. The genuine ones are on gosuslugi.ru. A root certificate gives an authority trust for any website, and a fake one is a gift to a fraudster.
• Counting on clearing the cache or another foreign browser alone. The ministry’s root is not included by default in Chrome, Safari, Firefox or Edge.

What we don’t promise

• That the banks’ certificates won’t change again. Banks change them without notice; our table is accurate as of October 26.
• That a Russian IP will remove the certificate warning by itself. It is removed by a browser that trusts the ministry, or by an installed certificate.
• That the bank will let you into your account through our location. We only checked the website’s response, without logging in and without the app.
• That the banks’ proposals will be accepted. The ministry received the letter; there is no decision yet.

Key takeaways

• According to the Association of Banks of Russia, every second bank has received customer complaints over revoked certificates.
• On October 26, 2026, 13 of the 15 addresses of banks and DOM.RF that responded to our server ran on the ministry’s certificates, which Chrome, Safari, Edge and Firefox don’t trust.
• The quickest way in is Yandex Browser: the ministry’s certificate is already built into it.
• You can stay in your own browser by installing three certificates from gosuslugi.ru. On an iPhone, don’t forget to turn on trust in Certificate Trust Settings.
• Abroad, SberBank Online may say “You can’t log in to SberBank Online in this browser” because of your foreign address. Then you need both Yandex Browser and a Russian IP: you can try a Liberum VPN location for free for 7 days.