Proton

UPDATE 4 November 2019: We are now using SwissSign AG(new window) as the certificate authority to issue our SSL/TLS certificate. Learn more about how to verify proton.me’s SSL certificate(new window).

UPDATE 11 October 2021: We are now using Let’s Encrypt(new window) as the Certificate Authority that verifies the SSL certificates used to secure the Proton Mail and Proton VPN web sites. For more information on this, and for instructions on how to check the validity of our certificate, please see Proton Mail’s TLS/SSL Certificate(new window).

Earlier today, the Electronic Frontier Foundation reported(new window) that the Emirati cybersecurity firm DarkMatter had applied to become a top-level certificate authority. Certificate authorities (CA) issue digital certificates which certify who owns a site, that the connection with a site is secure, and that a third party cannot intercept traffic. If a malignant actor were to become a CA, it could hand out fake certificates and potentially intercept HTTPS traffic.

The EFF article primarily focused on what would take place if DarkMatter, which has been accused of carrying out government surveillance by The Intercept,(new window) became a top-level CA that is trusted by browsers (which has not happened yet, and is unlikely to happen).

The connection to Proton Mail (and Proton VPN) arose because the Swiss company QuoVadis issued an intermediate certificate to DarkMatter and QuoVadis has also issued a certificate to Proton Mail. The fact that QuoVadis has issued a certificate to DarkMatter has led some people to call for everyone to delete QuoVadis certificates from their browser. This rash action is unwarranted and could lead to many websites not working, including Proton Mail and Proton VPN.

These rumors and allegations are mostly arising from people who do not understand how the CA system works or have incorrect information. Below, we will explain why none of this impacts Proton Mail’s security.

QuoVadis is not DarkMatter

Contrary to what some people have alleged, QuoVadis is not owned or controlled by DarkMatter. QuoVadis is owned by DigiCert, another independent CA. DigiCert is the Internet’s fifth largest CA and one of the largest Internet security companies in the world. It handles certificates and cybersecurity for some of the world’s best-known corporations, including PayPal and Cloudflare.

An intermediate certificate is not a root certificate

DarkMatter has an intermediate certificate issued by QuoVadis, and not a root certificate. This means that ultimately, DigiCert has oversight over all of the certificates which are issued using the intermediate certificate in question. Furthermore, using the Certificate Transparency system, Proton Mail routinely monitors the new certificates that are created. We will know if a new SSL certificate for proton.me is issued without our authorization.

QuoVadis’s certificates remain secure

Just because QuoVadis issued a certificate to DarkMatter, that does not imply that there is a problem with any of the certificates that QuoVadis has previously issued. Users of QuoVadis (in addition to Proton Mail) include switch.ch, the Swiss institution governing the .ch domain, as well as the Swiss federal government, the Canton of Zurich, ETH Zurich, and the Swiss bank Raiffeisen. While we don’t agree with the activities that DarkMatter has been involved in, and we believe that QuoVadis should revoke that certificate, it has no impact on the other certificates that QuoVadis has issued.

There is no reason to delete QuoVadis certificates, and doing so will impair your ability to access the Proton Mail and Proton VPN websites. Proton Mail does not rely on a single root CA to certify our sites, and QuoVadis/DigiCert is just one of the many CAs that we use. We use several CAs to ensure that we can rotate certificates rapidly if there is ever a compromise in the CA system. However, the fact that DarkMatter has been issued a certificate by QuoVadis does not imply that the CA system is compromised.

We routinely evaluate and check which CAs we do business with, and we will express to DigiCert our view that the certificate issued to DarkMatter should be revoked. The actions they take (or a lack of action) will certainly factor into our decision about whether or not we continue working with DigiCert in the future, even though there is no security issue with either Proton Mail or Proton VPN as a result of this certificate.

Best Regards,
The Proton Mail Team

Sign up and get a free secure email(new window) account from Proton Mail.

We also provide a free VPN service(new window) to protect your privacy.

Proton Mail and Proton VPN are funded by community contributions. If you would like to support our development efforts, you can upgrade to a paid plan(new window). Thank you for your support.


Protect your privacy with Proton
Create a free account

Related articles

proton scribe
Most of us send emails every day. Finding the right words and tone, however, can take up a lot of time. Today we’re introducing Proton Scribe, a smart, privacy-first writing assistant built right into Proton Mail that helps you compose and improve yo
People and companies are generally subject to the laws of the country and city where they are located, and those laws can change when they move to a new place. However, the situation becomes more complicated when considering data, which can be subjec
Your online data is no longer just used for ads but also for training AI. Google uses publicly available information to train its AI models, raising concerns over whether AI is even compatible with data protection laws. People are worried companies
iPhone stores passwords in iCloud Keychain, Apple’s built-in password manager. It’s convenient but has some drawbacks. A major issue is that it doesn’t work well with other platforms, making it hard for Apple users to use their passwords and passkeys
There are many reasons you may need to share passwords, bank details, and other highly sensitive information. But we noticed that many people do this via messaging apps or other methods that put your data at risk. In response to the needs of our com
Large language models (LLMs) trained on public datasets can serve a wide range of purposes, from composing blog posts to programming. However, their true potential lies in contextualization, achieved by either fine-tuning the model or enriching its p