ssl vpn with untrusted certificate is safe?

Forum|Forum|6 years ago
August 20, 2020
3 replies
9345 views

i am using ssl vpn with untrusted certificate, i wonder is this connection secure?

can someone give me an advice?

Best answer by Magion

Depends on what you define as safe :)

A self signed certificate allows for the same kind of encryption as a certificate issued by a external or internal PKI. As long as the private key is safe, your connection is good.

However an invalid certificate means you cannot verify the firewall you are connecting with. If your traffic is somehow rerouted to a different machine, you probably blindly accept the invalid certificate and not know you are connecting to the wrong firewall.

MagionAnswer

New Member

Depends on what you define as safe :)

A self signed certificate allows for the same kind of encryption as a certificate issued by a external or internal PKI. As long as the private key is safe, your connection is good.

However an invalid certificate means you cannot verify the firewall you are connecting with. If your traffic is somehow rerouted to a different machine, you probably blindly accept the invalid certificate and not know you are connecting to the wrong firewall.

cuongtlAuthor

New Member

Magion wrote:
Depends on what you define as safe :)

A self signed certificate allows for the same kind of encryption as a certificate issued by a external or internal PKI. As long as the private key is safe, your connection is good.

However an invalid certificate means you cannot verify the firewall you are connecting with. If your traffic is somehow rerouted to a different machine, you probably blindly accept the invalid certificate and not know you are connecting to the wrong firewall.

Hi Magion,

i want to know if the connection is untrusted then it is still encrypted?

sw2090

SuperUser

As long as you certificate is valid the connection is encrypted.

if it were invalid the vpn wouldn work at all because it cannot use the cert for encryption then

untrusted just means it cannot be verified. This is something common for self signed certs because the other side then does not know the CA that signed that cert so cannot verify it. But it is still usable as it should.

So as long as the cert is valid your vpn runs and is encrpted.

Sign up

Login with SSO

Login to the community

Login with SSO