Why Chrome marks Alfa-Bank's website as "Not secure"
At the same time, other state-owned banks (Gazprombank, VTB, Ingosstrakh) are fine..
This image could not be loaded.I opened alfabank.ru and saw a red warning with a crossed-out HTTPS. For a bank's website, this is a rather strange first encounter with the user.
What the check showed
A check on November 15, 2026 showed: the site serves a certificate for alfabank.ru signed by Russian Trusted Sub CA — a certificate authority of the Ministry of Digital Development. It is valid until February 27, 2027. The same certificate came from a Mac and a server in Germany; the standard trust check on the Mac rejected it.
The problem is in the compatibility of the trust chain: a browser without the corresponding trusted root certificate cannot confirm the authenticity of the site. This in itself does not prove a hack or a leak. But neither can the connection be considered reliably verified after bypassing the warning.
The bankexplains the situation on its pageand suggests installing Russian certificates or using Yandex Browser. Installing a root certificate changes the set of certificate authorities that the device or browser trusts. This is a significant decision that requires understanding its consequences.
What this means for the user
For me, this is primarily a product question. The user comes to solve a financial task but instead gets a task of configuring trust. It's clear that things are complicated in Russia right now.. But the same state-owned banks like Ingosstrakh, VTB, Gazprombank, for example, don't have such problems, which means the problem is most likely technical..