I've seen a lot of VPN providers and they all seem to agree on one thing: ask user to install their own Root CA.
I don't get why they do it. A legit server should have a certificate generated by trusted CA which means the certificate would be verifiable all the way down to the trusted root certificates installed on the device.
This is like trusting someone who says he's the president because he vouches for himself.
Why don't they have certificates generated by legit CAs? Their websites sure do. Why isn't this the case for their VPN Servers as well?
With that in mind, does it even make sense to use VPN for privacy? If the provider is able to perform MITM attacks then you're basically giving them everything including your money.
So this leads to my second question: how is this game working and no one is calling it out?
Extra: To be frank, I was thinking of turning my own device into a mini VPN server for some people I know. The only problem is verifying my server's certificate on the client side. Yes if I'm writing the client I can ignore this part, but that's dangerous for my friends' devices. Therefore, the solution I came up with was deploying my own Root CA certificate with my VPN client which will use it to verify my server and so they can connect to me. The thing is, if I paid a trusted CA to generate certificate for me I wouldn't need to ship my own Root CA certificate with my client.
Update: I have just checked my own VPN provider, it installs its own Root CA. So I went right ahead and removed the certificate from my system. Guess what, the VPN service was unaffected. So just a tip, try to uninstall the certificate if you have one, at least that way you can still prevent them from acting as MITM.