A VPN Does Not Turn a Certificate Warning Into Trust

Two things are being compared here and they are not the same kind of thing: the encryption of a path, and the identity of the server at its end. A VPN can make the first stronger while leaving the second entirely unanswered. That is why a warning about a name mismatch or an expired certificate does not become harmless when a tunnel is running. The padlock and the warning are talking about different properties.

A tunnel answers who carries the traffic; the certificate answers who receives it.

The Warning Is About Identity, Not Transport

The browser is reporting that the peer's certificate did not validate under the rules it was configured to apply. Those rules cover the name, the chain, the validity dates and the current time. A VPN changes none of them. Encrypting the path to a server with the wrong name produces an encrypted connection to the wrong server, which is not an improvement.

Incorrect device clocks cause this more often than people expect, particularly after a battery has been flat or a timezone change has gone wrong. Check the clock before concluding anything about the network.

Which Connection Actually Failed?

A portal page, a destination site and the VPN gateway each perform their own identity check, and the error names only one of them. Record the actual hostname and the exact message rather than treating every certificate as one object. On captive Wi-Fi, the portal commonly intercepts and presents its own certificate, which is why the operating system's normal sign-in flow exists. A familiar network name does not resolve any of this.

Use the venue's documented process rather than accepting an unrelated identity to reach a login page.

Installing a Root Is a Different Decision

When an organisation genuinely needs a trust configuration, it distributes that through managed profiles or a support process you can verify. A random page asking you to install a root certificate is describing an interception, not a fix. Accepting it lets the installer read everything the browser sends to every site that trusts that root. Those are not equivalent actions, and the second is hard to undo.

For the VPN gateway, use the operator's verified profile or a replacement identity issued by them. Removing verification to silence a warning can create a connection to an endpoint you did not intend.

A Tunnel Protects One Path Only

A correctly established tunnel protects the path it was built to protect. It does not authenticate every page you open, and it does not retrieve information already sent over a connection that was compromised. Those are properties of the browser's validation and of what happened earlier. A tunnel is a corridor, not a character reference for everyone at the end of it.

If a site's certificate is wrong, the useful question is whether you reached the intended site. A tunnel does not answer that, and it cannot.

Record the hostname, the error and the resolver or portal involved. That record separates a bad certificate from a bad path.