Skip to main content
added 256 characters in body
Source Link
Steffen Ullrich
  • 207.5k
  • 30
  • 416
  • 481

I’m aware the VPN server can encrypt/decrypt the traffic,

A VPN server by itself can not decrypt application traffic. When doing HTTPS over a VPN the HTTPS is still there after VPN exit. 

The company might have also some firewall/proxy though which does SSL interception, but. But this by itself has nothing to do with the VPN, except that due to the VPN the internet facing traffic might now pass through the company infrastructure and thus also through SSL interception. But this is just a "maybe" and it is not clear if the certificate you got is for thissuch SSL interception.

If I am already signed in to an email service before connecting to the VPN ...

Mail clientclients, web browsers, and other applications etc are often written in a robust way. If the connection breaks because a VPN gitgot established and thus traffic flows differently, then they might transparently try to re-establish the connection. It is not clear in your case if you even have a full VPN which passes all traffic through the company infrastructure, or a split VPN which is only about allowing company related traffic to communicate with the company infrastructure.

Can direct end-to-end encrypted messages services like iMessage, Messenger, etc be decrypted and read by the server ...

Real End-to-end message encryption like used in iMessage can not be intercepted by SSL interception or similar.

When not connected to VPN, does my iMac still make use of the installed cert when using the Internet normally?

If it was installed as a fully trusted root certificate, then it will use it as such, i.e. similar to Let's Encrypt and others. But it is not known how the certificate was actually installed.

Does the root cert have the ability to collect ...

The cert is not an active element which will do anything. A VPN client instead is an actual program and could in theory do such things, similar to any other program you use on your system - which does not mean that it actually does.

I’m aware the VPN server can encrypt/decrypt the traffic,

A VPN server by itself can not decrypt application traffic. When doing HTTPS over a VPN the HTTPS is still there after VPN exit. The company might have also some firewall/proxy which does SSL interception, but this by itself has nothing to do with the VPN and it is not clear if the certificate you got is for this SSL interception.

If I am already signed in to an email service before connecting to the VPN ...

Mail client, web browsers, applications etc are often written in a robust way. If the connection breaks because a VPN git established then they might transparently try to re-establish the connection. It is not clear in your case if you have a full VPN which passes all traffic through the company infrastructure, or a split VPN which is only about allowing company related traffic to communicate with the company infrastructure.

Can direct end-to-end encrypted messages services like iMessage, Messenger, etc be decrypted and read by the server ...

Real End-to-end encryption can not be intercepted by SSL interception or similar.

When not connected to VPN, does my iMac still make use of the installed cert when using the Internet normally?

If it was installed as a fully trusted root certificate, then it will use it as such, i.e. similar to Let's Encrypt and others. But it is not known how the certificate was actually installed.

Does the root cert have the ability to collect ...

The cert is not an active element which will do anything. A VPN client instead is an actual program and could in theory do such things, similar to any other program you use on your system - which does not mean that it actually does.

I’m aware the VPN server can encrypt/decrypt the traffic,

A VPN server by itself can not decrypt application traffic. When doing HTTPS over a VPN the HTTPS is still there after VPN exit. 

The company might have also some firewall/proxy though which does SSL interception. But this by itself has nothing to do with the VPN, except that due to the VPN the internet facing traffic might now pass through the company infrastructure and thus also through SSL interception. But this is just a "maybe" and it is not clear if the certificate you got is for such SSL interception.

If I am already signed in to an email service before connecting to the VPN ...

Mail clients, web browsers and other applications are often written in a robust way. If the connection breaks because a VPN got established and thus traffic flows differently, then they might transparently try to re-establish the connection. It is not clear in your case if you even have a full VPN which passes all traffic through the company infrastructure, or a split VPN which is only about allowing company related traffic to communicate with the company infrastructure.

Can direct end-to-end encrypted messages services like iMessage, Messenger, etc be decrypted and read by the server ...

End-to-end message encryption like used in iMessage can not be intercepted by SSL interception or similar.

When not connected to VPN, does my iMac still make use of the installed cert when using the Internet normally?

If it was installed as a fully trusted root certificate, then it will use it as such, i.e. similar to Let's Encrypt and others. But it is not known how the certificate was actually installed.

Does the root cert have the ability to collect ...

The cert is not an active element which will do anything. A VPN client instead is an actual program and could in theory do such things, similar to any other program you use on your system - which does not mean that it actually does.

Source Link
Steffen Ullrich
  • 207.5k
  • 30
  • 416
  • 481

I’m aware the VPN server can encrypt/decrypt the traffic,

A VPN server by itself can not decrypt application traffic. When doing HTTPS over a VPN the HTTPS is still there after VPN exit. The company might have also some firewall/proxy which does SSL interception, but this by itself has nothing to do with the VPN and it is not clear if the certificate you got is for this SSL interception.

If I am already signed in to an email service before connecting to the VPN ...

Mail client, web browsers, applications etc are often written in a robust way. If the connection breaks because a VPN git established then they might transparently try to re-establish the connection. It is not clear in your case if you have a full VPN which passes all traffic through the company infrastructure, or a split VPN which is only about allowing company related traffic to communicate with the company infrastructure.

Can direct end-to-end encrypted messages services like iMessage, Messenger, etc be decrypted and read by the server ...

Real End-to-end encryption can not be intercepted by SSL interception or similar.

When not connected to VPN, does my iMac still make use of the installed cert when using the Internet normally?

If it was installed as a fully trusted root certificate, then it will use it as such, i.e. similar to Let's Encrypt and others. But it is not known how the certificate was actually installed.

Does the root cert have the ability to collect ...

The cert is not an active element which will do anything. A VPN client instead is an actual program and could in theory do such things, similar to any other program you use on your system - which does not mean that it actually does.