To improve your security, Proton VPN no longer supports manual OpenVPN config files downloaded before September 2023. If you currently use older config files and wish to continue using manual OpenVPN configurations, you need to download new configuration files before the end of February 2026.
OpenVPN is an old VPN protocol that, although still robustly secure, is bloated and slow compared to powerful, sleek, and secure modern VPN protocols, such WireGuard® and our own Stealth protocol. This is why we are working toward discontinuing support for OpenVPN on our official apps.
Instead of manual OpenVPN configs, we recommend using:
- Our official apps (on supported platforms): These offer a wide selection of advanced features that are simply not possible using manual configuration. This includes support for our Stealth protocol, WireGuard TCP, and intuitive server selection using a graphic user interface.
- WireGuard (on everything else): WireGuard offers better performance than OpenVPN, while being equally secure. So where possible, we recommend using WireGuard on devices that only support manual VPN configuration (such as routers).
We only recommend using manual OpenVPN configuration on devices (typically older ones) that don’t support WireGuard.
Who is affected?
This update is required for everyone who currently uses OpenVPN configuration files downloaded before September 2023 to manually configure a device for Proton VPN.
What do you need to do?
- If your device(s) support our official apps or manual WireGuard configuration, we recommend switching to those.
- If you need to continue using a manual OpenVPN configuration, please download new OpenVPN configuration files and use them to re-configure your device.
- Learn how to download Proton VPN OpenVPN configuration files
- Learn how to download WireGuard configuration files
When do you need to do it?
You need to update your OpenVPN configs before the end of February 2026. After February 28, your old configurations will no longer work.
What’s changing?
At Proton VPN, we always maintain the highest possible security standards. To ensure this and other improvements, our newer OpenVPN configuration files use:
- AES-256-GCM (instead of AES-256-CBC): With built-in integrity, support for parallel processing, and other efficiency improvements, AES-GCM is faster, stronger, and causes less battery drain than AES-CBC.
- Newer server certificates: The newer X.509 certificates use stronger signature algorithms and longer validity periods to improve the chain of trust and resistance to certain attacks.
- tls-crypt + tls-auth (instead of just tls-auth): tls-auth verifies that a packet really comes from a client that knows the shared secret. Adding tls-crypt means the entire packet (including its length and payload) is encrypted, so an attacker can’t read or guess its shape. This makes passive sniffing and crafted‑packet attacks much harder.
A faster and more secure OpenVPN
Although still secure, OpenVPN is an old and inefficient VPN protocol. Where possible, you should upgrade to a better, more modern alternative (our official apps, or manual WireGuard configuration on routers and the like).
However, OpenVPN is still very secure, and so remains fine for use on devices that don’t support the newer protocol. In this case, updating your manual configuration to use to our newer OpenVPN certificates will result in a faster and even more secure VPN setup.
