At work, my employer uses a self-signed root certificate to MITM all of our SSL/TLS traffic. Many of our internal certificates used by various micro-services and internal websites are also signed by this certificate.
I have no real issue with this practice as it's their network and equipment.
Recently, there has been a decision made to switch from Citrix to VPN for remote access. As part of the VPN configuration, my employer installs the self-signed root certificate into the trusted certificate store.
I am concerned that this at least potentially gives certain personnel within the firm the ability to decrypt encrypted traffic from my home computer. The certificate is a PKS#7 certificate signed by and issued to the same entity.
There has been no transparency into this process and it feels very shady to me. I asked about any potential security issues this could effect but was told that since the certificate is issued by a "trusted source" my concerns are unfounded. I am not a security guy but claiming this is issued by a "trusted source" seems like a stretch.
My question to you is, is this normal or acceptable practice and is there anything that I should be concerned about?
I don't like the idea of someone even having the potential to snoop my family's internet traffic without disclosure nor policy.
Am I being unreasonable?
Thank you in advance.