I have an application where there I'm planning the following setup:

user  <-----------------> layer 1 server <------------------> backend server
        internet (https)                    RPC through VPN

So when a user makes a request, it goes through standard SSL/TLS to the layer 1 server, then that has a program that calls a software in another location through the internet, which is connected to the layer 1 server through an OpenVPN connection.

To simplify the design of my application, I'd prefer that the RPC connection is without SSL/TLS. I'm thinking of that VPN connection as a replacement to the security requirements of a TLS encrypted connection. Does this provide the same security level?

The RPC sends user/password data to the server, which it just forwards to the backend server after wrapping it with some other objects.

What are the expected drawbacks from such a design?

1 Answer 1


A VPN provides protection between system at the network level, SSL/TLS instead provides protection between applications at the application level. The first might be enough in some cases and might not be sufficient in others. For example: if you want the client application to authenticate itself against the API then VPN is not enough since it at most could authenticate the clients machine against the servers machine. Also, more trust into the machine is needed if the protection ends at the network level (VPN) and not at the application level (SSL/TLS).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .