ProtonVPN to retire legacy OpenVPN configs for security reasons

Proton VPN has announced it will deprecate support for all manually downloaded OpenVPN configuration files issued before September 2023.

Users relying on these outdated files must update their configurations or switch to newer protocols by February 28, 2026, to avoid service disruption.

The update is part of Proton’s broader push toward modernizing its VPN infrastructure. While OpenVPN remains a secure protocol, the company emphasizes that it is now considered bulky and inefficient compared to alternatives like WireGuard or Proton’s proprietary Stealth protocol. As a result, Proton is gradually phasing out OpenVPN support in its official apps and encouraging users to transition away from legacy configurations.

The announcement targets users who manually configure devices using OpenVPN, particularly on routers or unsupported platforms where Proton’s apps are not available. Anyone using configuration files downloaded prior to September 2023 will need to take action to maintain uninterrupted service.

Proton VPN is a privacy-focused VPN provider operated by Proton AG, the Swiss company behind Proton Mail and other encrypted services.

According to the bulletin, Proton’s updated OpenVPN configuration files incorporate several security enhancements:

• AES-256-GCM encryption, replacing the older AES-256-CBC. This update boosts performance and battery efficiency while improving data integrity through authenticated encryption.
• Upgraded X.509 certificates with stronger digital signatures and longer validity periods, enhancing resistance to certain classes of cryptographic attacks.
• TLS enhancements, replacing tls-auth with a combination of tls-auth and tls-crypt. This ensures not only packet authenticity but also encrypts packet metadata, providing better protection against passive sniffing and crafted-packet attacks.

Proton recommends using its official apps on supported platforms to take advantage of advanced features, including protocol switching (e.g., WireGuard TCP), Stealth mode for censorship evasion, and a graphical interface for easier server selection. On devices that don’t support these apps, such as certain routers, Proton advises switching to manual WireGuard configurations where possible. Manual OpenVPN setups should only be used when no alternative exists.

For users who must continue with OpenVPN, the company has made updated configuration files available for download and strongly advises completing the transition before the February 28 deadline. After that point, outdated configuration files will cease to function.

Last month, Mullvad VPN unveiled GotaTun, its own Rust-based WireGuard implementation, and finalized the removal of OpenVPN support from its desktop clients. Like Proton, Mullvad cited performance, stability, and long-term maintainability as key drivers for the transition.