1

When using openvpn --config /home/xxx/vpnbook-uk1-udp25000.ovpn I always get this warning:

Sat Feb 22 11:16:04 2014 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.

Very possibly this is related with this issue I'm having.

What should I do about this Man in the Middle Attack warning?

  • Well, if you open that link, you'll get instructions to enable server certificate verification. Doing that is good idea. – Olli Feb 22 '14 at 19:38
  • @Olli Ive been to that link and it points me to several places and requires things I dont understand and its too complicated for Me right now.Also im not sure but the keys need to be implemented by vpnbook not Me.I would understand it eventually if i had more time – user251046 Feb 23 '14 at 8:29
1

In this case, your client is not validating the server. To prevent man in the middle attacks, mutual verification is required, that is, you authenticate yourself to the server (you probably have either certificates or username and password), and your client automatically validates identity of the server.

Just connecting to specific address is not enough to actually authenticate the server.

To fix this, refer to linked documentation from the warning message. To validate the identity of the server, you need CA certificate that was used to sign server's certificate. If the VPN server is maintained by someone else, you should ask them. After getting appropriate CA file, add ca path/to/ca.crt directive to your configuration file.


Many will hate me for saying this, but often fixing that warning is not important. It really boils down to why you use VPN. If it is to provide little additional privacy when using public wifi, there's really high chance it does not matter. If everything you run over VPN is encrypted (e.g ssh and HTTPS), MitM could be nuisance and security risk, but not a dealbreaker.

If you do something that requires high confidentiality and integrity, you definitely should fix this, especially if that activity is unencrypted (e.g HTTP, IMAP, telnet).

| improve this answer | |
  • Ive just emailed contact@vpnbook.com about this.What if they wont answer? – user251046 Feb 24 '14 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.