Proton

UPDATE 4 November 2019: We are now using SwissSign AG(nova janela) as the certificate authority to issue our SSL/TLS certificate. Learn more about how to verify proton.me’s SSL certificate.

UPDATE 11 October 2021: We are now using Let’s Encrypt(nova janela) as the Certificate Authority that verifies the SSL certificates used to secure the Proton Mail and Proton VPN web sites. For more information on this, and for instructions on how to check the validity of our certificate, please see Proton Mail’s TLS/SSL Certificate.

Earlier today, the Electronic Frontier Foundation reported(nova janela) that the Emirati cybersecurity firm DarkMatter had applied to become a top-level certificate authority. Certificate authorities (CA) issue digital certificates which certify who owns a site, that the connection with a site is secure, and that a third party cannot intercept traffic. If a malignant actor were to become a CA, it could hand out fake certificates and potentially intercept HTTPS traffic.

The EFF article primarily focused on what would take place if DarkMatter, which has been accused of carrying out government surveillance by The Intercept,(nova janela) became a top-level CA that is trusted by browsers (which has not happened yet, and is unlikely to happen).

The connection to Proton Mail (and Proton VPN) arose because the Swiss company QuoVadis issued an intermediate certificate to DarkMatter and QuoVadis has also issued a certificate to Proton Mail. The fact that QuoVadis has issued a certificate to DarkMatter has led some people to call for everyone to delete QuoVadis certificates from their browser. This rash action is unwarranted and could lead to many websites not working, including Proton Mail and Proton VPN.

These rumors and allegations are mostly arising from people who do not understand how the CA system works or have incorrect information. Below, we will explain why none of this impacts Proton Mail’s security.

QuoVadis is not DarkMatter

Contrary to what some people have alleged, QuoVadis is not owned or controlled by DarkMatter. QuoVadis is owned by DigiCert, another independent CA. DigiCert is the Internet’s fifth largest CA and one of the largest Internet security companies in the world. It handles certificates and cybersecurity for some of the world’s best-known corporations, including PayPal and Cloudflare.

An intermediate certificate is not a root certificate

DarkMatter has an intermediate certificate issued by QuoVadis, and not a root certificate. This means that ultimately, DigiCert has oversight over all of the certificates which are issued using the intermediate certificate in question. Furthermore, using the Certificate Transparency system, Proton Mail routinely monitors the new certificates that are created. We will know if a new SSL certificate for proton.me is issued without our authorization.

QuoVadis’s certificates remain secure

Just because QuoVadis issued a certificate to DarkMatter, that does not imply that there is a problem with any of the certificates that QuoVadis has previously issued. Users of QuoVadis (in addition to Proton Mail) include switch.ch, the Swiss institution governing the .ch domain, as well as the Swiss federal government, the Canton of Zurich, ETH Zurich, and the Swiss bank Raiffeisen. While we don’t agree with the activities that DarkMatter has been involved in, and we believe that QuoVadis should revoke that certificate, it has no impact on the other certificates that QuoVadis has issued.

There is no reason to delete QuoVadis certificates, and doing so will impair your ability to access the Proton Mail and Proton VPN websites. Proton Mail does not rely on a single root CA to certify our sites, and QuoVadis/DigiCert is just one of the many CAs that we use. We use several CAs to ensure that we can rotate certificates rapidly if there is ever a compromise in the CA system. However, the fact that DarkMatter has been issued a certificate by QuoVadis does not imply that the CA system is compromised.

We routinely evaluate and check which CAs we do business with, and we will express to DigiCert our view that the certificate issued to DarkMatter should be revoked. The actions they take (or a lack of action) will certainly factor into our decision about whether or not we continue working with DigiCert in the future, even though there is no security issue with either Proton Mail or Proton VPN as a result of this certificate.

Best Regards,
The Proton Mail Team

Sign up and get a free secure email(nova janela) account from Proton Mail.

We also provide a free VPN service(nova janela) to protect your privacy.

Proton Mail and Proton VPN are funded by community contributions. If you would like to support our development efforts, you can upgrade to a paid plan. Thank you for your support.


Artigos relacionados

Illustration of a QR code inside an envelope with an alert symbol suggesting the code is part of a scam
en
Quishing works by tricking people into scanning a scam QR code disguised to look legitimate. Here's how to protect yourself from quishing scams.
Can I change my Gmail address without creating a new account?
en
This article will guide you through several ways you can edit your Gmail address by adding a few small tweaks.
A stylized icon resembling the Google Photos logo with a dark triangular warning sign containing an exclamation mark, representing Google Photos safety issues
en
Is Google Photos secure to share private pictures? Here's how its protections can fall short — and other options for safer photo sharing.
how to change your email address
en
  • Guias de privacidade
Learn how to change your email address across email services, including Gmail, Yahoo, Outlook, and iCloud without risking your data.
Who is responsible for protecting CUI?
en
  • Guias de privacidade
This article breaks down CUI, the parties responsible for marking and guarding it, and what goes into keeping it secure.
The cover image for a Proton Pass blog about how to change your Facebook password settings. The image shows the Facebook icon with a password field beneath it and a tick at the end of the password field
en
Here's a step-by-step guide for how to change or reset your Facebook password settings — and how to create a strong password you'll remember with Proton Pass.