FlyerTalk Forums - View Single Post - Self-Signed Certificate for VPN
View Single Post
Old Jan 27, 2017 | 2:57 pm
  #4  
docbert
2M
60 Nights
50 Countries Visited
15 Years on Site
 
Join Date: Jul 2007
Location: Brisbane, Australia
Programs: UA 1K/MM, Marriott Titanium, IHG Gold, Hertz PC, Avis PC
Posts: 8,531
Originally Posted by ajGoes
... our VPN host site does not have a valid one. Given that we access the VPN by IP address, how serious a risk does the invalid certificate pose?
Given that you're accessing it via IP address, a valid certificate will add zero value as they are tied to a hostname - so even with a valid cert you'll get a trust error.

However even if you were using a hostname, the answer is "it depends"! What type of VPN are you using? Is it one that use use a web browser to access (in which case you should be using a hostname, and a valid cert, and your IT people deserve to be sacked for doing otherwise), or is it one that uses a specific client?

"Valid" SSL certs are frequently not needed when using non-web-based VPNs. CA-signed SSL certs are used as a way of generating trust via a 3rd party, when you can't confirm that trust directly. You trust the CA, the CA trusts the SSL cert, and thus you trust the SSL cert.

For a VPN server, it's not uncommon to simply trust the SSL certificate directly - in which case a "self-signed" certificate is perfectly fine. (In practice it might not actually be 'self' signed, but it's basically the same thing). For example, with OpenVPN you would normally create a private key for the server, then put the public part of that key onto every client - that creates the trust relationship, so so no CA-signed certificate is required.
docbert is offline