Is Commerzbank quantum-safe?
Partly. 11 of 80 public servers under commerzbank.de use post-quantum key exchange, the protection against traffic recorded today being decrypted once a large quantum computer exists. Grade C. Scanned October 18, 2026.
Fix first
Production login, API, VPN, payment and developer servers that still rely on key exchange scheduled for retirement.
- app-analyse.commerzbank.de
- app-pilot.commerzbank.de
- app.ccbpk-tuc.commerzbank.de
- app.commerzbank.de
65 other servers without post-quantum key exchange
- accesstoaccount.commerzbank.de
- cmt-test.commerzbank.de
- cobaq-test.commerzbank.de
- cobaq.commerzbank.de
- commanderweb-demo.commerzbank.de
- commerzbank.de
- delivery-dev.ci360.tpp.commerzbank.de
- delivery-tuc.ci360.tpp.commerzbank.de
- delivery-tud.ci360.tpp.commerzbank.de
- delivery.ci360.tpp.commerzbank.de
- events.commerzbank.de
- fints-pilot.commerzbank.de
- fints.commerzbank.de
- firmenkunden.commerzbank.de
- fxlivetraderweb-demo.commerzbank.de
- fxlivetraderweb.commerzbank.de
- fxonboarding.commerzbank.de
- hbci.commerzbank.de
- information.commerzbank.de
- kreditkartenbanking.commerzbank.de
- kunden-analyse.commerzbank.de
- kunden-pilot.commerzbank.de
- kunden.ccbpk-tuc.commerzbank.de
- kunden.commerzbank.de
- kundenzugang-analyse.commerzbank.de
- kundenzugang-pilot.commerzbank.de
- kundenzugang.commerzbank.de
- md.commerzbank.de
- mobil-analyse.commerzbank.de
- mobil-pilot.commerzbank.de
- mta-sts.commerzbank.de
- mta-sts.kreditkartenservice.commerzbank.de
- mydispute.commerzbank.de
- mydisputetest.commerzbank.de
- service-corporates.commerzbank.de
- service-firmenkunden.commerzbank.de
- service.commerzbank.de
- sicher-einkaufen.commerzbank.de
- sst-comdirect-dev.commerzbank.de
- sst-comdirect-tuc.commerzbank.de
- sst-comdirect-tud.commerzbank.de
- sst-comdirect.commerzbank.de
- static.commerzbank.de
- stg-cobrand.commerzbank.de
- stg-commercial.commerzbank.de
- syntheticmon.commerzbank.de
- tc.commerzbank.de
- tctuc.commerzbank.de
- tctud.commerzbank.de
- tp.commerzbank.de
- tpdev.commerzbank.de
- tptuc.commerzbank.de
- tptud.commerzbank.de
- vermoegensverwaltung.commerzbank.de
- vopf.commerzbank.de
- www.ccbpk-tuc.commerzbank.de
- www.commerzbank.de
- www.events.commerzbank.de
- www.firmenkunden.commerzbank.de
- www.kreditkartenbanking.commerzbank.de
- www.service-corporates.commerzbank.de
- www.service-firmenkunden.commerzbank.de
- www.service.commerzbank.de
- www.sicher-einkaufen.commerzbank.de
- www.vermoegensverwaltung.commerzbank.de
11 servers already protected
- content-dev.ci360.tpp.commerzbank.de
- content-tuc.ci360.tpp.commerzbank.de
- content-tud.ci360.tpp.commerzbank.de
- content.ci360.tpp.commerzbank.de
- execution-dev.ci360.tpp.commerzbank.de
- execution-tuc.ci360.tpp.commerzbank.de
- execution-tud.ci360.tpp.commerzbank.de
- execution.ci360.tpp.commerzbank.de
- filialsuche.commerzbank.de
- information.ci360.tpp.commerzbank.de
- tcdev.commerzbank.de
What this means
NIST has scheduled the key exchange most servers still use for retirement: deprecated after 2030, disallowed after 2035 (NIST IR 8547). Traffic recorded today can be decrypted once a large quantum computer exists. A server that offers hybrid ML-KEM key exchange closes that today; a server that does not is still open to harvest now, decrypt later.
Hostnames come from public certificate logs plus common service names, kept where the name resolves to a public address, and each is tested from the outside with post-quantum-only TLS 1.3 handshakes. A hostname shows what a server is called, not what traffic it carries; internal systems are out of scope. Method.
Work at Commerzbank?
Fleet Watch gives you this scan privately every week, with your suppliers and a report your auditor can verify. The first scan is free.
Scan your own domainBadge
Shows the current grade and updates itself. Anyone may embed it.
<a href="https://latticescan.com/readiness/commerzbank.de"><img src="https://latticescan.com/badge/readiness/commerzbank.de" alt="quantum readiness"></a>