This could be exploited both by them to do a MitM, by a security enforcing office (NSA) with a legal mandate served to NordVPN, or even by a hacker that is able to get into NordVPN's supply chain.Īs I said, all this is not needed for providing VPN services. NordVPN, is acting as Root CA in this case and as such is capable of issuing CAs for any domain they need to serve.SSL works at the transport level, so this is additional unnecessary encryption for a VPN provider

They provide VPN services and the whole VPN tunnel is encrypted at the network and/or data link layer.

NordVPN DOES NOT need to do this in order to provide their services.

That being said, there's a few things worth noting: Given that NordVPN is one of the biggest VPN providers I'd say this is probably not a MitM attack. I came across the same issue yesterday on a computer I was supporting. Or, as suggested in comments, check which root CA signed it. Still, if you want to double check that nothing fishy is going on, you could check if the certificate you receive, while using the VPN, is valid on a different machine that you have not installed any of the software in question on. It's just a very unlikely explanation of what you are seeing. If you have installed some software on your machine, that software could manipulate your trust store and make false certificates appear legitimate. That said, what you are worried about is technically possible.

In other words: Just because the two certificates are different, doesn't mean that one of them must be false. I guess that you are not located in the same place as your VPN exit node? Then, one explanation would be that your requests are reaching a different server closer to your VPN exit node when you are using the VPN, and that that different server is using a different certificate. It may use different ones for a number of reasons. Websites don't have to use the same certificate for all visitors. This is most likely not a man-in-the-middle attack.

Nordvpn fedora