VPN Portal Installer: Package, Profile or Rebuild?

A VPN portal's download button returns exactly one file, and that file can be two very different things: a stock vendor installer with a configuration profile travelling beside it, or a build the organization compiled itself. The page looks the same either way, so the button cannot tell you which one you have. Three questions sit behind it — who published the executable, what configuration the install writes, and who repairs it when the next client release lands. You answer the first from artifact metadata, the second from the package contents, and the third only from the team that owns the deployment.

The browser padlock covers the transfer, not the artifact.

What the Download Endpoint Actually Returns

Most portals hand a download request to a small handler that either streams a stored file or assembles one on the fly, then sets a filename and a content type before the response leaves. What arrives is a container: an MSI, a PKG, a DEB or RPM, or a self-extracting wrapper around one of those. Inside sits the client binary, and nothing in the filename reliably says whether that binary came from the vendor or from an internal build pipeline. A file called client-setup.exe records a naming decision, not a provenance fact.

Compare the downloaded bytes with the vendor's published checksum. A mismatch does not prove malice; it proves the file is not the vendor build, which is the distinction worth acting on.

Where the Profile Enters the Client

Prefilled settings usually travel as a separate file that the installer copies into a per-user or per-machine path: a JSON or XML profile on Windows, a configuration profile on macOS, a fragment under /etc on Linux. Values in that file — gateway hostnames, trust anchors, sometimes enrollment material — become the client's defaults at first launch. This is why one download can carry secrets as well as code.

Ask what the upgrade path does with the profile. Depending on packaging it may survive a client update, be overwritten by it, or fail schema validation in the new version.

What the Signature Chain Does Not Prove

Code signing binds a publisher identity to a file hash, and on Windows the Authenticode timestamp lets a signature outlive the certificate that made it. A valid result answers two questions: which publisher signed these bytes, and whether they changed afterwards. It does not enumerate the installer's services, registry writes or bundled drivers, and it does not decide whether that publisher should be trusted here. Microsoft's Authenticode documentation describes the mechanism and is explicit about that narrow scope.

Portal authentication answers a third question, that the session reached the intended server. Three different checks, three different failure modes.

Verify the Artifact Before Anyone Runs It

Put the file on an isolated machine and read its metadata before executing anything. These commands answer the publisher question on the three mainstream platforms.

# Windows PowerShell
Get-AuthenticodeSignature .\client-setup.exe | Format-List Status, SignerCertificate, TimeStamperCertificate

# macOS
pkgutil --check-signature ./Client.pkg
codesign -dv --verbose=4 /Applications/Client.app

# Debian/Ubuntu
dpkg-deb -I ./client_amd64.deb
sha256sum ./client_amd64.deb

Read the signer subject rather than the status word alone. An internal certificate authority signing an in-house build is expected; the same certificate on a package that claims to be the vendor's release is not.

For a profile-only package, open the archive and treat every embedded hostname and key as data that must be accounted for. If the profile holds anything reusable, portal distribution turns it into a shared secret with a rollout schedule.

Settling Ownership Before Rollout

The last question has no command behind it. Find out who updates the artifact when the vendor ships a new client, who holds the signing key for an internal build, and how the profile is rotated when an endpoint moves. Write those names next to the download link.

If nobody owns that answer, the download is a distribution channel without a maintenance contract, and that is the finding worth reporting.