“Your connection is not private” on Sberbank, VTB, Alfa-Bank and Russian Railways sites: what to do

You open the Sberbank, VTB or Alfa-Bank website, and instead of the login page your browser says “Your connection is not private” and suggests going back. The site won’t open on your computer or your phone, even though the rest of the internet works fine. Since August 2026, customers of most major Russian banks have been seeing this error in Chrome, Safari, Edge and Firefox, and since August 20, so have users of the Russian Railways (RZD) website.

It’s not a hack, and nothing is wrong with your device. The banks switched to certificates from the Ministry’s national certification centre, whose root is called Russian Trusted Root CA, and foreign browsers don’t trust them by default. Below: what exactly is going on, which sites served such a certificate in our October 3, 2026 check, how to install the ministry’s certificates or manage without them, and what won’t help.

What the “Your connection is not private” error looks like in browsers and apps

The wording of the warning depends on the browser, but the cause is always the same: the browser couldn’t verify who issued the site’s certificate.

• Chrome and Edge on computers and Android: “Your connection is not private” or a similar warning with the error code NET::ERR_CERT_AUTHORITY_INVALID.
• Safari on Mac, iPhone and iPad: “This Connection Is Not Private.” For the RZD site on an iPhone, RIA Novosti also quoted the explanation: “This website may be impersonating www.rzd.ru to steal your personal or financial information.”
• Firefox: “Warning: Potential Security Risk Ahead” with the code SEC_ERROR_UNKNOWN_ISSUER.
• A website shortcut on your phone’s home screen (a web app): it’s the same site, so you get the same error, as Rossiyskaya Gazeta reported.

Bank apps usually keep working: they don’t use the browser’s list of trusted authorities. On August 7, the ministry stressed that official bank apps still provide access to all services. There are caveats: T-Bank advises updating its app to the latest version, which has Russian certificates built in, and the RZD Passengers app on an iPhone needs the ministry’s certificates installed. On Android, according to RZD, it works without them.

Why the Sberbank website won’t open: certificates from Russia’s Ministry of Digital Development and Russian Trusted Root CA

Every https website presents your browser with a certificate, an electronic document that proves you’ve reached the real site and lets the connection be encrypted. It’s issued by a certification authority. The browser checks the chain: the site’s certificate is signed by an issuing authority, which is signed by a root authority, and the root must be on the trusted list built into your operating system or the browser itself. If the root isn’t on the list, the browser can’t confirm the site is genuine and shows a warning.

Since June 2026, foreign certification authorities have been revoking the certificates of Russian companies. GlobalSign started on June 13, and according to Rossiyskaya Gazeta, Let’s Encrypt, Actalis, HARICA and TrustAsia also revoked certificates of Russian banks over the summer. The banks switched to certificates from the Ministry’s national certification centre: its root certificate is called Russian Trusted Root CA, and its issuing certificate is Russian Trusted Sub CA. The authority has been operating since 2022, but browsers and operating systems from foreign vendors don’t include its root by default. Hence the error: the certificate works and the connection is encrypted, but the browser doesn’t know the authority that issued it.

The ministry’s certificate is already built into Yandex Browser (partner link), so bank sites open there without any setup, as both the ministry and Yandex itself confirm.

Timeline: how banks and Russian Railways moved to certificates from Russia’s Ministry of Digital Development

Our October 3, 2026 measurement: a Russian IP doesn’t remove the error

To check whether the error depends on the country, on October 3, 2026, we requested the home pages of the banks and RZD from four countries: two home networks in Russia (Rostelecom in Nizhny Novgorod and MTS in Novosibirsk), a home network in Germany (Deutsche Telekom, Berlin), a home network in Kazakhstan (Kazakhtelecom, Almaty) and our own server in a data center in Tbilisi. The table shows who issued the certificate each site served. “Russian CA” means the certificate was issued by Russian Trusted Sub CA, the Ministry’s national certification centre.

Wherever a connection was made, the site served the same Russian CA certificate, including on Russian home networks. So the error depends not on your country or IP address, but on whether your browser trusts the ministry’s root. From Germany and from the Tbilisi data center, the RZD site didn’t respond at all: no connection was made within the time limit, and the certificate had nothing to do with it. From Kazakhstan, rzd.ru responded to a probe on the NLS Kazakhstan network (the Kazakhtelecom probe was offline at the time), while for bspb.ru the probe in Kazakhstan returned no result.

In our check from Tbilisi, a Russian CA certificate was also served by the login pages online.sberbank.ru, online.vtb.ru, web.alfabank.ru and id.tbank.ru, and by the sites of MKB, Rosbank, DOM.RF Bank, MTS Bank, Bank Rossiya, Bank Zenit, Absolut Bank, VBRR, Bank Sinara, the National Card Payment System (nspk.ru) and Rosstat, Russia’s statistics agency. Meanwhile, Gosuslugi, Gazprombank, Raiffeisenbank, OTP Bank, Russian Standard Bank and Ozon Bank were using certificates from foreign authorities that browsers trust on the same day.

How we measured: we requested the home page from each location, through the open Globalping measurement network and our own probe in Tbilisi. We only checked the home page certificate, not logging in to an account and not the apps. Sites change certificates without notice, so the table is a snapshot as of October 3, 2026.

What won’t help: a VPN, a Russian IP, changing DNS or clearing the cache

• A VPN or a Russian IP. From Russian home networks, the sites serve the same certificate as from Germany or Kazakhstan, as the measurement above shows. And on August 20, RIA Novosti recorded the error on the RZD site for users inside Russia itself.
• Changing DNS. DNS only tells your device the server’s address, and it’s the server itself that serves the certificate. In our check, sberbank.ru pointed to the same address in Russia, Germany and Kazakhstan.
• Clearing the cache or using incognito mode. The site’s certificate doesn’t change because of it. Clearing the cache doesn’t fix the certificate error: if the error persists, T-Bank advises clearing it.
• Another foreign browser. Chrome, Safari, Edge and Firefox all lack the ministry’s root by default.
• The “Advanced” → “Proceed to the site” button. The page will open, but clicking doesn’t verify anything; it only turns the warning off. Don’t enter your password or codes on a page like that: experts point out that the same error also appears during a real attack on your connection.

Do you need to install the certificates from Russia’s Ministry of Digital Development by hand?

No. Bank and RZD websites open in Yandex Browser without any extra steps: it already has the certificates from Russia’s Ministry of Digital Development built in. In other browsers you can install the certificates by hand following the official Gosuslugi instructions (gosuslugi.ru/crt), but we don’t recommend it: a root certificate trusts any website that presents it, and it’s simpler to open the site in Yandex Browser.

Without installing anything: Yandex Browser or the bank’s app

• Yandex Browser. The ministry’s certificate is already built in, so bank and RZD sites open without any setup. You can keep it just for Russian sites. On phones, T-Bank advises making Yandex Browser the default browser, otherwise online transfers and payments may fail.
• VK’s Atom browser is also named in 2026 articles as supporting the ministry’s certificates, but when we checked on October 3, 2026, RuStore listed it as unavailable for download. Don’t count on it.
• The bank’s app. If you have it, use it: the ministry stresses that official apps keep working. Update it to the latest version.

Is it safe to install the certificates from Russia’s Ministry of Digital Development?

The ministry calls installation safe: its certificates work the same way as those from foreign authorities and don’t affect how your device works. A certificate isn’t a program: it doesn’t run anything on your phone or computer, it only tells the browser which sites to trust.

But it’s worth understanding what you’re agreeing to. By adding a root certificate, you allow your device to trust certificates its owner issues for any website; every root certificate works this way, Russian or foreign (Finuslugi). That’s why people install them deliberately and only from the official page. For comparison: according to its help pages, Yandex Browser accepts certificates from such authorities only if they’re recorded in two public Certificate Transparency logs, a mechanism that helps spot a certificate issued by mistake or by fraudsters.

If you only need your bank occasionally, a narrower option is a separate browser or the bank’s app. You can remove an installed certificate at any time; we explain how in the questions below.

If a bank website won’t open for a different reason

• A warning on every site. Most likely your device’s date and time are wrong or your antivirus is interfering; the ministry’s certificates have nothing to do with it.
• A warning on one site you reached via a link. Check the address character by character: fake sites differ by a single letter or the domain zone.
• The site opened, but the bank won’t let you in or asks you to turn off your VPN. That’s no longer the certificate but the bank’s own checks. We explain how they work for people abroad in a separate guide: how to log in to SberBank Online and T-Bank from abroad.

Key takeaways

• “Your connection is not private” on the sites of Sberbank, VTB, Alfa-Bank and other banks is the result of their switch to certificates from the ministry’s authority, whose root isn’t in Chrome, Safari, Edge or Firefox.
• In our October 3, 2026 measurement, the sites of 9 major banks and RZD served this certificate, both in Russia and abroad.
• A VPN, a Russian IP, changing DNS and clearing the cache don’t remove the error.
• The official options: certificates from gosuslugi.ru/crt, Yandex Browser or the bank’s app.
• A root certificate means trusting a certification authority for any website: install it deliberately and only from Gosuslugi.