I've read somewhere that HTTPS can be compromised by having a CA Root Certificate installed as a method of 'HTTPS Inspection'.

How can I know if my VPN service provider doesn't do HTTPS Inspection and if it does, what are the things I can do to prevent unauthorized Root CA installation in my browser?


Any process running with our privileges our higher can in theory install a new root certificate. But that does not mean that it will do it. If you take for example the VPN support bundled into Windows (PPTP, L2TP/IPSec) then there is no way for the server to push a new root certificate to your system. The same is true with the original OpenVPN client.

But, if your VPN provider asks you to install specific software to use their VPN then it might be possible that this software will already install a new root CA when you install the software or that it will do it later when instructed by the VPN server. Or it might do even worse things.

VPN software is in this case no different from all the other software you download and install to your system: it can do a lot of harm (adding a new root CA, monitoring you through your webcam, capture all your keystrokes...) and you should install it only if you really trust the vendor and the path how the software gets distributed.

| improve this answer | |
  • Can you enumerate some trusted VPN service providers? – 唐龍豹 Jul 1 '17 at 9:35
  • 2
    @GeorgePaoloFlores: This would be first a different question but product recommendations are off-topic anyway. And, the most trust-worthy VPN is probably to use your own VPN server. There are several resources online on how to do this. – Steffen Ullrich Jul 1 '17 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.