Suppose I have set up my PC at home to be a VPN server. If I access the Internet on my mobile via this VPN and the connection is TLS-based, will the TLS encryption end after reaching the VPN server?


Assuming you don't mean "the connection is TLS-based" as in "the VPN service is TLS-based": No.

TLS is end-to-end protection, established from your client (browser) to the address (typically a web server or load balancer, sometimes a proxy or reverse proxy server) that you're trying to reach. The server is located by IP address and authenticated by ensuring it has a trusted TLS certificate for that service, and the corresponding private key. None of the switches, routers, or other devices - including VPN servers - along the route will terminate the TLS until it reaches the destination host (although that host might terminate TLS and then send another request, possibly a plain-text one, beyond that; this is pretty common for load balancers serving a cluster of servers).

VPNs are transparent tunnels; the TCP connection that your browser makes to the server you want to use TLS with will be wrapped inside the VPN tunnel between your device and your VPN server, and then transparently forwarded to its actual destination by the VPN server; responses will be tunneled back to you. VPN servers can monitor and even tamper with traffic flowing through them, but that's where the end-to-end protection of TLS comes into play: assuming that your VPN server does not have the target host's private key (or a fraudulent but trusted certificate for that host), the VPN server can neither decrypt nor (usefully) change the TLS traffic, save by just closing the connection.

Of course, some VPNs do use TLS for the VPN connection itself. Those TLS connections obviously end at the VPN server (because your device established a TLS connection with the VPN server, not with something beyond it, when it connected to the VPN). However, even in that case, if you then make a TLS connection through the VPN to some other server, then your "some other server" TLS connection will be tunneled through your VPN TLS connection. In that case, tunneled TLS connection will still be the same TLS connection after being forwarded by the VPN server, and the VPN server will still have no idea what it says.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.