Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
cuongtl
New Contributor

ssl vpn with untrusted certificate is safe?

i am using ssl vpn with untrusted certificate, i wonder is this connection secure?

can someone give me an advice?

1 Solution
Magion
Contributor

Depends on what you define as safe :)

 

A self signed certificate allows for the same kind of encryption as a certificate issued by a external or internal PKI. As long as the private key is safe, your connection is good.

 

However an invalid certificate means you cannot verify the firewall you are connecting with. If your traffic is somehow rerouted to a different machine, you probably blindly accept the invalid certificate and not know you are connecting to the wrong firewall.

View solution in original post

3 REPLIES 3
Magion
Contributor

Depends on what you define as safe :)

 

A self signed certificate allows for the same kind of encryption as a certificate issued by a external or internal PKI. As long as the private key is safe, your connection is good.

 

However an invalid certificate means you cannot verify the firewall you are connecting with. If your traffic is somehow rerouted to a different machine, you probably blindly accept the invalid certificate and not know you are connecting to the wrong firewall.

cuongtl
New Contributor

Magion wrote:

Depends on what you define as safe :)

 

A self signed certificate allows for the same kind of encryption as a certificate issued by a external or internal PKI. As long as the private key is safe, your connection is good.

 

However an invalid certificate means you cannot verify the firewall you are connecting with. If your traffic is somehow rerouted to a different machine, you probably blindly accept the invalid certificate and not know you are connecting to the wrong firewall.

Hi Magion,

i want to know if the connection is untrusted then it is still encrypted?

sw2090
Honored Contributor

As long as you certificate is valid the connection is encrypted.

if it were invalid the vpn wouldn work  at all because it cannot use the cert for encryption then

 

untrusted just means it cannot be verified. This is something common for self signed certs because the other side then does not know the CA that signed that cert so cannot verify it. But it is still usable as it should.

So as long as the cert is valid your vpn runs and is encrpted.

 

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
Labels
Top Kudoed Authors