We recently decided to pay an ISP (a substantial sum, mind) for a managed internet service up to and including the router in our head office.
Part of the initial discussions made it clear that whatever solution the ISP thought was best it had to include a VPN as various members of staff are on the road a lot, coffee shops and trains and the like.
The ISP delivered a VPN solution in the form of Cisco AnyConnect which keeps showing security warnings as the certificate is self-signed. The certificate is also SHA-1.
1) My main question is this. Is this adequate security for a paid-for solution?
2) My second question (although it may be out of place in this area of SE) is this. Is it reasonable to assume the ISP would provide an adequate solution certificate given that the sensitive nature of the data we transmit was divulged to them?