ssl vpn with untrusted certificate is safe?

[cuongtl]

i am using ssl vpn with untrusted certificate, i wonder is this connection secure?

can someone give me an advice?

[Magion · Accepted solution]

Depends on what you define as safe :)

A self signed certificate allows for the same kind of encryption as a certificate issued by a external or internal PKI. As long as the private key is safe, your connection is good.

However an invalid certificate means you cannot verify the firewall you are connecting with. If your traffic is somehow rerouted to a different machine, you probably blindly accept the invalid certificate and not know you are connecting to the wrong firewall.

[cuongtl]

Magion wrote:

Depends on what you define as safe :)

A self signed certificate allows for the same kind of encryption as a certificate issued by a external or internal PKI. As long as the private key is safe, your connection is good.

However an invalid certificate means you cannot verify the firewall you are connecting with. If your traffic is somehow rerouted to a different machine, you probably blindly accept the invalid certificate and not know you are connecting to the wrong firewall.

Hi Magion,

i want to know if the connection is untrusted then it is still encrypted?

[sw2090]

As long as you certificate is valid the connection is encrypted.

if it were invalid the vpn wouldn work  at all because it cannot use the cert for encryption then

untrusted just means it cannot be verified. This is something common for self signed certs because the other side then does not know the CA that signed that cert so cannot verify it. But it is still usable as it should.

So as long as the cert is valid your vpn runs and is encrpted.