VPN & Browser Root Certificates: A Guide

TL;DR

Yes, a VPN client can install a CA (Certificate Authority) root certificate into your web browser’s trust store. This is often done to allow the VPN to intercept and decrypt your web traffic for security or filtering purposes. However, it also means the VPN provider can see your browsing data, so understand the implications before allowing this.

How a VPN Installs Root Certificates

1. The Need: Many VPNs use their own CA to issue certificates for websites you visit while connected. Your browser needs to trust this CA to verify those certificates and establish a secure connection.
   Without the root certificate, your browser will show security warnings because it doesn’t recognise the issuing authority.
2. Installation Process: The VPN client usually prompts you during setup or when connecting for the first time. It might present a window asking if you want to install a new CA certificate.
   Sometimes, the VPN provides a link to download the certificate file (usually in .crt or .pem format).
3. Browser-Specific Instructions: The installation steps vary depending on your browser:
   • Chrome/Edge: Chrome and Edge share the same underlying certificate store. You’ll typically be directed to your operating system’s settings.
     On Windows, search for ‘Manage computer certificates’, go to ‘Trusted Root Certification Authorities’, then import the .crt file. On macOS, open Keychain Access and drag-and-drop the .crt file into the ‘System’ keychain.
   • Firefox: Firefox has its own certificate store.
     Open Firefox settings (about:preferences in the address bar), search for ‘certificates’, click ‘View Certificates’, then import the .crt file under the ‘Authorities’ tab.
   • Safari: Safari uses the macOS Keychain Access, similar to Chrome/Edge on macOS.

Checking if a Root Certificate is Installed

1. Chrome/Edge: Type chrome://settings/certificates in the address bar.
   Look for the VPN provider’s CA certificate in the list.
2. Firefox: Open Firefox settings (about:preferences), search for ‘certificates’, click ‘View Certificates’.
   Check under the ‘Authorities’ tab.
3. Safari: Open Keychain Access.
   Search for the VPN provider’s CA certificate in the ‘System’ keychain.

Risks and Considerations

1. Trust: Installing a root certificate gives the VPN provider significant control over your web connections.
   They can decrypt your traffic, even to websites using HTTPS. Only install certificates from VPN providers you trust completely.
2. Security Warnings: If the certificate is revoked or tampered with, your browser will show security warnings.
   Pay attention to these warnings and investigate before proceeding.
3. Removal: You can remove the root certificate if you no longer use the VPN.
   Follow the same steps as installation but choose ‘Remove’ instead of ‘Import’.

Example Command (Linux – adding to system trust store)

This is a less common scenario, but some Linux VPN clients might require manual certificate addition. Use with caution and only if instructed by the VPN provider.

sudo cp vpn_provider_root.crt /usr/local/share/ca-certificates/

sudo update-ca-certificates

Further Information

Always refer to your VPN provider’s documentation for specific instructions on installing and managing their root certificate.