I am using CISCO VPN client when working remotely to join company's VPN. Once every 2-3 months I receive an alert like the following:


SSL Network Extender


Gateway's fingerprint has changed. Press Yes to accept [..]
CN: [the address of the site I am accessing to provide credentials to enter into VPN]
Old Fingerprint: HIGH CORD [..]
New Fingerprint: RAG RAVE [..]

I am wondering how safe is to blindly accept this change or should I talk to local IT to define a flow that allows VPN users to validate this fingerprint.

Question: CISCO VPN Client - Gateway's fingerprint has changed - what is the risk of simply accepting the change?

  • You should contact the VPN owner/administrator. See Silver's answer.
    – Overmind
    Feb 6, 2019 at 8:38

1 Answer 1


The fingerprint changed because the server side certificate changed. This can mean that your IT department has changed the certificate on the server. If it is every 3 months, it is quite likely that this is the case.

Alternatively, if this message appears, someone else is acting as you VPN server and does not have the correct certificate to create the same fingerprint as before. This warning is then a clear indication that you are sending your credentials to a malicious VPN server.

To be safe, always contact the system administrator if you see such a warning. In HTTPS, there are mechanisms which make it very hard to even ignore these types of warnings.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .