0

As one can see on the screenshot below, connecting to the company VPN via FortiClient issues a X509 verify certificate failed.

I have informed the CIO who is the security person as well but it is not a priority for him. I can understand to some extent.

However, I would like to make him aware of the potential risks if any.

Maybe I'm just plain wrong but I thought that using the VPN as is leads to less security (MITM attack for example) as opposed to rely on SSH only.

Is my company exposed to a significant flaw until the certificate is fixed?

enter image description here

Improve this question
4
  • I'm not sure about your question. On the one site you say that the CIO is a security person which suggests to me that they understand the implications of the problem. On the other side you still want [what exactly?] to convince them to fix it faster. Which kind of implies that you see a fix more urgent than the CIO. But - we have only the information you give here which are likely the information the CIO has too. Then there is some context we don't have which makes the CIO to come to different conclusions regarding the urgency to fix it than you. We cannot help w/o this additional context.
    – Steffen Ullrich
    Nov 4, 2022 at 15:49
  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.
    – Community Bot
    Nov 4, 2022 at 16:22
  • Actually, stating that he is the security person is misleading, let's instead say "accountable" for security concerns. I can't tell for sure that he understand the implications of the problem, and neither do I. Also, note that we do not own/operate the VPN directly (it is operated by a third party). I'm looking to ensure that we are not exposed to a significant flaw.
    – David
    Nov 4, 2022 at 16:23
  • Is the hostname correct?
    – schroeder ♦
    Nov 4, 2022 at 16:30

1 Answer 1

Reset to default
1

Is my company exposed to a significant flaw until the certificate is fixed?

Maybe, maybe not.

If the certificate is actually the intended one than it is a usability nuisance which can lead to security problems in the long run: users are expected to understand this error and check that the certificate is actually the intended ones by comparing the fingerprint or other attributes, which is bad usability. Or users are just trained to skip such warnings, which they will then do an later occasions too even if the certificate is not the expected one - and which would then be a security problem like a MITM attack.

If the certificate is not the intended one, than making users accept it anyway leads to a successful MITM attack, which is definitely a security problem.

So it should better be fixed. How urgent the fix is depends on factors like amount of VPN users affected and the technical knowledge of these users, i.e. if they understand the implications and can properly deal with it or if they simply ignore any warnings.

... note that we do not own/operate the VPN directly (it is operated by a third party).

If the problem is on their end (and not due to misconfiguration on your side) you might question, how much trust you have in the competence of this third party to keep your network secure.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .