<?xml version="1.0" encoding="utf-8"?>
<!--
  ~ Copyright (c) 2022 Proton AG
  ~
  ~ This file is part of Proton Mail.
  ~
  ~ Proton Mail is free software: you can redistribute it and/or modify
  ~ it under the terms of the GNU General Public License as published by
  ~ the Free Software Foundation, either version 3 of the License, or
  ~ (at your option) any later version.
  ~
  ~ Proton Mail is distributed in the hope that it will be useful,
  ~ but WITHOUT ANY WARRANTY; without even the implied warranty of
  ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  ~ GNU General Public License for more details.
  ~
  ~ You should have received a copy of the GNU General Public License
  ~ along with Proton Mail. If not, see https://www.gnu.org/licenses/.
  -->
<network-security-config>

    <domain-config>
        <domain includeSubdomains="true">mail-api.proton.me</domain>

        <trustkit-config
            disableDefaultReportUri="true"
            enforcePinning="true">
            <report-uri>https://reports.proton.me/reports/tls</report-uri>
        </trustkit-config>

        <!-- Valid pins -->
        <pin-set>
            <!-- Before SwissSign cert -->
            <pin digest="SHA-256">+0dMG0qG2Ga+dNE8uktwMm7dv6RFEXwBoBjQ43GqsQ0=</pin>
            <!-- After SwissSign cert -->
            <pin digest="SHA-256">CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=</pin>
            <!-- Hot backup -->
            <pin digest="SHA-256">35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=</pin>
            <!-- Cold backup -->
            <pin digest="SHA-256">qYIukVc63DEITct8sFT7ebIq5qsWmuscaIKeJx+5J5A=</pin>
        </pin-set>

    </domain-config>

    <domain-config enforcePinning="true">
        <domain includeSubdomains="true">localhost</domain>
        <trustkit-config
            disableDefaultReportUri="true"
            enforcePinning="true" />
    </domain-config>

    <base-config cleartextTrafficPermitted="true" />

</network-security-config>
