I'm using mail.com over HTTPS. I sent a mail and I was connected over my access to the company VPN. Is it possible that the administrator of my company can read my mails? I used Firefox / Webbrowser Login of mail.com
Yes. In your case, since the VPN connects to your company, it is possible that they may have visibility into your outgoing web traffic. They will see anything over plain HTTP, but many companies nowadays are breaking SSL/TLS at their boundaries in order to inspect it. A good indicator to check if they are doing this is to go to a site that uses HTTPS (like Google) and then click the lock icon in your browser to view the certificate. If the certificate doesn't have Google's information in all of the fields, it means that they are decrypting HTTPS and can see your traffic.
Many companies install their own CA SSL certificates so they can decrypt
HTTPS traffic. This essentially allows the company to do a Man In The Middle attack on the encrypted
HTTPS connection, and read the traffic in plaintext.
If you're using a computer given to you and configured by your company, it's possible that they've installed one of these certificates on your computer. If this is your own personal PC, and your company hasn't ever installed software on it or otherwise configured it, it's unlikely they've installed their own fake CA cert.
You should be able to check this yourself. You'll need to go to your mail providers site, and examine the certificate it's received. This is done in different ways in different browsers. In Chrome hit
F12, in the console that's created go to the security tab and click on view certificate.
For Mail.com as of May 2018, I see:
Common Name (CN) GeoTrust RSA CA 2018 Organization (O) DigiCert Inc Organizational Unit (OU) www.digicert.com
DigiCert is a legit Certificate authority.
If it's issued by a legitimate certificate authority like Digicert above, your mail is safe from being viewed by your company. If it's issued by something else, like your company or another fake CA created by a network device, your company can potentially read your email.