0

Lets say i have connected to a VPN server using Linux with the help of Cisco anyconnect protocol or PPTP protocol.

now when i try to connect to it, it says :

The certificate may be invalid or untrusted!
Reason: signer not found

I kinda know the owner of the server but i do not fully trust them.

So if i connect to this and click connect anyway, will they be able to decrypt and read my HTTPS data? for example when i connect to a website that firefox says connection is secure, will they be able to read my login info like username/passwords?

2
  • "when I try to connect" - is that when you try to connect to the VPN or when you visit a website?
    – nobody
    Dec 28 '20 at 19:02
  • @nobody when i try to connect to the server
    – OneAndOnly
    Dec 28 '20 at 19:04
1

In general, TLS MiTM can replace one self signed cert with another and then see all your traffic.

When you click through the error for a self-signed certificate and connect to the HTTPS server regardless, unless you have viewed the certificate hash (fingerprint) or the public key's hash (fingerprint) and verified it is the same value as last time (when you are reasonably sure you were not MiTM'd), the self-signed certificate can be replaced by another self-signed certificate and you wouldn't notice. Anyone in main-in-the-middle position can do that and then read (and modify!) all traffic.

Checking that the certificate (or public key) are the same as values you trust is called certificate pinning. Some apps do this in code, with the trusted hash baked into the code, and then it makes sense and means using self-signed certs (or certs issued by an untrusted corporate CA) is secure.

Performing the certificate pinning check manually is possible, but I would not trust a user to do it diligently.

But this only lets you know whether the certificate is different from last time. How do you know the certificate is good the first time? If you are MiTM'd the first time, verifying on subsequent connections that the cert is the same won't help. That is kinda the problem with self-signed certs and what CAs like Let's Encrypt solve. But if you have an out-of-band way to know the cert is legit on the first connection (e.g. site owner published hash of cert on twitter), relying on pinning for subsequent connections is ok.

Why not use a trusted Let's Encrypt certificate?

If you mean the certificate of the VPN itself is self-signed, then apply all of the above to a MiTM between yourself and the VPN. But HTTPS connections using legit certificates performed inside the VPN should be secure from the VPN operator. They will know which sites you connect to, but they will not see your passwords. Traffic analysis can let them guess the content you browse based on data sizes and timing. For example, popular netflix movies and wikipedia articles are recognizable in encrypted traffic just by the size of the download!

1

No, as long as you do not import their CA into your trusted store. The browser is likely unaware of the VPN tunnel and will continue to make and verify secure connections as normal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.