If my understanding of how VPNs operate is correct, all traffic between me and the Internet at-large is routed through the VPN's servers. So an attacker would only be able to see encrypted traffic between the VPN and me and wouldn't be privy of its content nor its true destination. The destination wouldn't be able to see where the request originally came from (ie: me) either. Am I right so far?
So when SSL comes in play here, how does it all work? Suppose I am going to Gmail via the VPN. Since the VPN connects to Gmail on my behalf (and vice versa), wouldn't they need to decrypt communications between Gmail and my computer, and re-encrypt them again to send to both ends? If that's the case:
- obviously, wouldn't this mean the VPN can see all plaintext communications?
- and if the above is true, wouldn't it be a MITM attack?
- and if the above is true, and I haven't installed any new trusted root certificates, why doesn't my browser alert me?
The question is about VPNs in general, but I am using OpenVPN.