5

I am building an OpenVPN server in AWS for my organization with a DNS record pointing it to vpn.myOrgnization.com.

SIDE NOTE: We have recently migrated all of our SSL certificates over to the new (and free!) ACM (Amazon Certificate Manager), but I cannot install this on the OpenVPN server because ACM only supports Amazon's elastic load balancers and CloudFront (meaning I cannot install the certs directly on the OpenVPN server).

My question is, what is the risk to having a self-signed certificate on our OpenVPN server? Is the risk simply the possibility of MitM when administering the OpenVPN server? I also assume that when a user navigates to the vpn.myOrganization.com domain, a MitM could impersonate our OpenVPN server to steal VPN credentials. But, once the OpenVPN client is configured with proper authentication, is there any future risk? Can the already-configured VPN connection be MitM'ed each time the client connects? My understanding is no. The OpenVPN protocol does not rely on the self-signed SSL certificate to the server, but I am certainly no expert on the OpenVPN protocol.

Any thoughts or suggestions would be greatly appreciated. We will likely just purchase a wildcard cert for our domain, rather than only relying on the free Amazon Certificate Manager, but I was also generally curious as to what this risk is (even though we will be mitigating it with a cert anyway).

Thanks in advance for the thoughts.

Improve this question

2 Answers 2

Reset to default
5

If you are using OpenVPN for your organization it is probably better not to use any public certificates for OpenVPN but create your own CA and only accept certificates issued by this CA. This is actually the way proposed in the OpenVPN Howto. This way you are in full control of the certificates and even if some of the public CA's gets compromised and issues certificates in your name then none of your OpenVPN endpoints will accept these, because only certificates issued by your own CA gets accepted.

Apart from that: Using a self-signed certificate does not impose a risk by itself, not for VPN and not for HTTPS. The risk is only if the certificate is not fully validated. A self-signed certificate can not be validated without additional information like the fingerprint received over a secure channel (like phone or printed) and that's why it is common to just skip the validation completely because it looks too hard. Thus not the use of self-signed is the risk but not properly verifying it is.

Improve this answer
2
  • Thanks for the advice on the CA. Yes, the risk is in that one can impersonate a ticket stating it was created by OpenVPN and then intercept the VPN credentials. I realize the connection is still encrypted, but the server is not verified.
    – jay-charles
    Jan 28, 2016 at 17:26
  • @jay-charles: if the server is not verified a man in the middle attack is possible. This not only includes stealing the VPN credentials but intercepting the traffic or modifying the traffic. Since VPN connections are often considered as safe as internal connections inside the company the attacker can thus get access to interesting data or mount attacks against internal clients.
    – Steffen Ullrich
    Jan 28, 2016 at 17:51
3

Off the top of my head, you should be concerned about someone imitating the VPN server and then accepting the user's credentials, which they can replay. Does the VPN Client provide a warning that the cert cannot be verified? If so, then I suggest installing the cert on the machines as trusted, so that they do not get the warning. Then, teach the users that if they see the cert error, there is a problem/security risk and don't proceed to login.

Improve this answer
2
  • I did not think of this. Yes, we can deploy the self-signed certificate that is pre-installed by the OpenVPN AMI that we used, so that the endpoints trust this cert. The VPN client does throw up a warning up connecting to an untrusted cert. I'm assuming we'd install it in the Windows certificate manager, although I'm not sure how this works on Mac (we do have some in our organization; I'm sure Google will tell me!). I also assume that our Firefox users would not be able to admin the OpenVPN web GUI without a certificate warning since FireFox uses its own cert manager, as I understand it.
    – jay-charles
    Jan 28, 2016 at 17:30
  • The MitM should not be a problem if the openvpn client validates the server certificate. My understanding is that the openvpn client just needs to validate that the openvpn server certificate was signed by the same issuer that signed the client's certificate. So, I don't think you shouldn't have to install it in the Windows certificate manager!
    – Tom Rutchik
    Sep 14, 2022 at 22:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .