0

I’d like to have an AlgoVPN server that uses a trusted CA to issue a certificate for the VPN server.

I am currently using an AlgoVPN server, which is completely setup via Ansible scripts and automatically creates user profiles (mobileconfig files for iOS). This works fine for loading via an MDM or manually, but it uses a self-signed root cert and I'd like it to use a trusted CA to issue the certificate for the VPN server. However, in the process of looking at this possibility, I found some conflicting information about whether what I want to do is even a good idea.

In response to a similar question on a different VPN server, the feedback was: “Never use a public/globally trusted cert with your VPN. You will allow anyone anywhere with a cert from the same CA access to your VPN, reducing your overall security even with additional layers like TLS keys. Use a self-signed CA/Cert structure. There is zero benefit to using an ACME or other trusted cert and massive disadvantages by doing so. We will not fix an issue that would degrade security in this way.” Someone else said "I don't think using a public CA is an issue, unless the public CA gets compromised. Which could of course happen."

I don't really understand the issue. Can someone explain the security issues with doing what I'd like to do? It is unsafe?

1 Answer 1

0

If the certificate authority gets hacked (unlikely, but it has happened several times), they can generate another certificate, and trick your client into thinking their VPN server is your VPN server, and watch all your VPN traffic. That's because if you use a CA, your VPN client will accept any certificate signed by a CA that says it's the right server, not just the certificate you generated.

If it's a self-signed certificate, then they can't do that.

2
  • Do most VPN servers use self-signed certificates then? Would security experts generally think that using trusted CA to issue the certificate is a bad idea for a VPN server? Thanks for your response! It is helpful but still leaves me wondering whether I should pursue this avenue or not. FYI, just for context, the reason I want to do this is that I'm trying to parse a mobileconfig and use the cert information to initiate the VPN connection programmatically in iOS, but it complains about the root cert and won't allow it (though as I said the mobileconfig can be manually loaded).
    – alf
    Commented Oct 24, 2019 at 10:59
  • Every time a CA is hacked, the whole Internet is in a bit of trouble. It's a rare event but it does happen. You can choose whether to use a CA certificate or your own self-signed certificate. Commented Oct 25, 2019 at 8:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .