I'm using vpn tunnel for some URLs, and when I check the certificate chain in the browser for a URL page that goes through the vpn, I see that that except the leaf certificate, all other certs were replaced by the vpn.

I was wondering why this is happening. I thought that vpn is just another layer in the packet that is being removed once the incoming packet pass the first stage of the vpn interface, and the inner packet is being dealt on the http level by the appropriate interface driver just as it used to be without the vpn on the way.

Where am I go wrong here?

  • This indicates the VPN is decrypting your traffic, doing something with it and re-encrypting it. It's not just encrypting the encrypted traffic again. – user253751 May 5 at 20:13
  • but what is the purpose of changing the http session certificate chain ? is it done since the actual http session is between the VPN and the target URL, and my client just get the redirected packets ? – Zohar81 May 5 at 20:17
  • 1
    In this specific case, yes. It's not a normal occurence with VPNs, but if you're seeing a custom/untrusted root CA, then it does indeed mean that your specific VPN is maliciously intercepting the HTTPS sessions. (The actual security of HTTPS rests on the idea that only the "real" server can send the real certificates; an interceptor has no choice but to replace them with fake ones, causing security alerts in your browser.) – user1686 May 5 at 20:28

It's done by the network operator of the particular VPN that you're using.

VPNs are just a way to get access to a remote network without actually being there. They don't alter your traffic, but the remote network itself certainly can.

For example, just like some ISPs redirect all DNS requests to the same server, any network can do that, including a VPN provider's network. And just like school networks often perform "HTTPS inspection" which intercepts TLS connections and replaces certificates with its own, a malicious VPN operator can certainly do the same.

(In other words, the VPN only protects your traffic in transit until it gets to the VPN server – once it's at the VPN server, it's again completely in the clear.)

Do keep in mind that some large websites may legitimately have multiple certificates at the same time (even from different CAs), and requests from different locations could be reaching different instances and see different certificates that way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.