I spoke to a sysadmin in a business center today who intended to basically perform a MiTM (as he called it) on every connection in his network because people in his office building are using VPNs and https connections to stream video, download torrents etc.. These services use up all the bandwidth but because they are encrypted connections his load balancer doesn't work.
The security firm he hired convinced him it is possible to set up a proxy server with his own valid and signed certificate (for the proxy server of course) which would dupe all browsers and VPN connections to accept the proxy as their endpoint. This would allow him to decrypt all traffic, verify its content and throttle if necessary, encrypt it once more and send it on its intended way without anyone being the wiser.
On the https part I managed to explain/convince him that any half decent https implementation is meant specifically to avoid MiTM attacks because certificates are linked to a specific domain or company. There is no way his proxy can dupe a browser to think it is connecting to the website while in fact connecting to the proxy server.
However, concerning VPNs he is adamant (or better yet, the security firm he hired for his network) that many VPN services or protocols will accept any certificate signed by a CA to create a secure connection. Whether or not that certificate is actually attributed to the server you are connecting to is not checked.
This seems highly unlikely to me and contrary to everything I know of secure connections but before I pick up that discussion I want to make sure I'm not missing some little known vulnerability in VPN protocols of software that very few people know about.
My question: is it true that some VPN protocols or VPN software will only check the validity of a certificate by checking whether it is signed by a CA and will not at all verify if the certificate is in fact attributed to the server you are connecting to?
-- small edit -- To specify why this should be possible: according to the security firm quite a few VPN softwares will accept any valid certificate and do not check if the certificate is actually linked to the server: any valid certificate is accepted.