I’d like to have an AlgoVPN server that uses a trusted CA to issue a certificate for the VPN server.
I am currently using an AlgoVPN server, which is completely setup via Ansible scripts and automatically creates user profiles (mobileconfig files for iOS). This works fine for loading via an MDM or manually, but it uses a self-signed root cert and I'd like it to use a trusted CA to issue the certificate for the VPN server. However, in the process of looking at this possibility, I found some conflicting information about whether what I want to do is even a good idea.
In response to a similar question on a different VPN server, the feedback was: “Never use a public/globally trusted cert with your VPN. You will allow anyone anywhere with a cert from the same CA access to your VPN, reducing your overall security even with additional layers like TLS keys. Use a self-signed CA/Cert structure. There is zero benefit to using an ACME or other trusted cert and massive disadvantages by doing so. We will not fix an issue that would degrade security in this way.” Someone else said "I don't think using a public CA is an issue, unless the public CA gets compromised. Which could of course happen."
I don't really understand the issue. Can someone explain the security issues with doing what I'd like to do? It is unsafe?