EarthVPN certificate configuration vulnerabilities

[y6whynrzab () snkmail com]

EarthVPN (www.earthvpn.com) is a VPN service provider which claims "When connected, your data will be secured and 
encrypted, keeping all your personal details private. EarthVPN will make sure that your online presence cannot be 
intercepted, monitored and recorded by your internet service provider, company, school or government."

Their server configuration and suggested openvpn setup guide contains a number of vulnerabilities.

- The provided CA certificate earthvpn.crt is actually a public certificate authority ("GlobalSign Root CA"). This 
means that anybody can register for a valid SSL certificate from GlobalSign.

- the setup guide did not advise to enable the "certificate hostname check" (under "authentication/encryption"). This 
means that a certificate issued by GlobalSign to, say, fbi.gov will pass certificate validation, and can result in an 
active man-in-the-middle attack that could eavesdrop on all traffic.

- They appear to be using the same certificate ("*.earthvpn.com") and keys on all servers that I've tried to connect 
to. This means that compromise of any one of these servers would allow the theft of private keys that can be used to 
m-i-t-m any other server. Put another way, a Russian dissident might want to connect to their  UK servers to avoid 
interception of his traffic. But the Russian government could compel the datacentre in Russia hosting their server to 
reveal its keys. And it can use these keys to intercept and monitor the traffic to the UK server (or other servers).

EarthVPN has been contacted about these concerns, and insists that "it is not possible to do mitm attack without 
knowing username and password of the clients as authentication will not be succeeded."