I've been searching and searching, but I can't seem to find a good-enough technical explanation. From what I've gathered, there are two "things" able to secure VPNs:
1) Pre-Shared Key: This handles authentication, because each side has to have the same key. However, how are the actual packets encrypted, and how does the VPN appliance know how to decrypt them? The PSK isn't a symmetric key (I hope, since it's short), so..
2) Certificates: This makes conceptual sense to me - the server certificate is used to encrypt the data, and the client certificate is used to authenticate the client. Right? So the client provides their public certificate to the server in advance to be able to identify them (or chain trust is established?), and each packet is encrypted and then signed and then encapsulated in another packet for travel?
I understand conceptually the concept of tunneling, but I'm trying to figure out the actual encryption implementation details, and I'm having difficulty. If anyone could provide some answers or point me to some resources that I could read, I would greatly appreciate it.
A few additional notes:
I don't have any particular VPN appliance in mind.
VPN should mitigate MITM attacks, since the data should be encrypted in such a way that only the end appliance can decrypt it, right? Or only the client and the end appliance can, in the case of a symmetric key.
SSTP and IPSec were mentioned, but I can't find the relevant details to answer my above questions.