When accessing any of the Mailfence services, the transmission of data between your device program and our servers in Brussels-Belgium is always encrypted and protected by SSL/TLS – for which each website has a (Public Key) Certificate that is verified by a trusted Certificate Authority (CA).
A modern browser should automatically check the validity of the Mailfence SSL/TLS certificate and alert you if it detects something untrustworthy. In case an adversary succeeds in spoofing Mailfence (using a rogue SSL/TLS certificate), you will still be able to detect such an (AiTM) attack by manually checking Mailfence SSL/TLS certificate fingerprints.
The Mailfence SSL/TLS certificate fingerprints [valid until May 26th, 2024, 09:20 AM (Central European Summer Time)] are:
SHA1 fingerprint:
C4:A4:2A:4B:F3:F3:04:F4:59:8B:B2:75:AF:04:11:6C:5C:6C:AA:B8
SHA-256 fingerprint:
C5:7E:4D:B2:00:6D:CA:DF:12:BC:2D:B6:E0:B5:AD:92:FD:E4:C0:7C:14:B0:9B:65:BD:EF:41:CE:F1:98:05:CD
If this matches what you see in your browser, then you know you are communicating with the right Mailfence website/service and using the correct public key to encrypt your sensitive information and only Mailfence can decrypt it.
Last updated: March 2024
Next update date: May 2024
Guidelines:
- For Chrome:
- Click on the green padlock in the address bar.
- Click on the Certificate.
- In General, verify that the Fingerprints (SHA1 & SHA-256) matches the one’s above.
- For Firefox:
- Click on the lock button in front of the URL and click on the Arrow on the right side of the dropdown.
- Click on Connection Secure.
- Click on More Information.
- Go to Security and click on View Certificate.
- Verify that the Fingerprints (SHA1 & SHA-256) matches the one’s above.
- For Safari:
- Click on the lock button in front of the URL.
- Select Show Certificate, in Details scroll to the bottom of the page.
- Verify that the Fingerprints (SHA1 & SHA-256) matches the one’s above.
Note: Make sure, in your browser, you are looking at the leaf certificate (mailfence.com, *.mailfence.com). This certificate does not cover blog.mailfence.com and kb.mailfence.com domain names.
For further assistance, feel free to drop us an email at support@mailfence.com
At Mailfence – a secure and private email service, we believe in following good security practices, to contribute in providing you a secure and private email solution. Learn more about who we are.