Current workaround to see the connection status: click on the applet, select "Network Settings".
It says "Connected" under wifi.
Or type ifconfig in a terminal and see if there's a tunnel up.

How can cinnamon 3.4.0 not have this fix?

I have the exact same issue; what would it take for it to be fixed in Cinnamon 3.4?

Would it be possible to, at least, create a simple applet that would serve as a vpn indicator?
After some research, it appears to be an issue that keeps happening to a few users. Obviously, knowing whether one is securely connected at a glance is beyond useful.
Sadly, my knowledge in creating applets is rather limited, anyone would know how to go about it?

In my case, this issue had to do with NetworkManager "managing" the tun0 interface that gets created when a VPN connection is established by nm-applet. Here's how I figured this out and resolved. YMMV.

Establish your VPN connection via nm-applet. No lock icon, whant whant! Let's see what NetworkManger is up to, run the following...

$ nmcli d

DEVICE     TYPE      STATE        CONNECTION 
tun0       tun       connected    tun0   
wlp4s0     wifi      connected    SomeWifiNetwork     
enp0s31f6  ethernet  unavailable  --         
lo         loopback  unmanaged    --  

Now, lets delete the tun0 interface (don't worry, nm-applet re-creates the tun0 interface upon next start of your VPN connection)...

$ nmcli connection delete tun0

This interrupts your VPN connection but you'll instantly see the pretty lock icon appear as desired. Let's now tell NetworkManager to no longer "manage" the tun0 interface.

Open /etc/NetworkManager/NetworkManager.conf in your favorite editor via sudo as file is owned by root and add the following...

[keyfile]
unmanaged-devices=interface-name:tun0

Now restart NetworkManager (the entire service, not only nm-applet) or reboot if you're lazy or unsure how to do so. Establish your VPN connection via nm-applet and viola, you'll have that purdy lock icon. In closing, lets take another look at nmcli...

$ nmcli d

DEVICE     TYPE      STATE        CONNECTION 
wlp4s0     wifi      connected    SomeWifiNetwork     
enp0s31f6  ethernet  unavailable  --         
lo         loopback  unmanaged    --         
tun0       tun       unmanaged    -- 

As we can see tun0 is now "unmanaged" and nm-applet is happy, with VPN working as expected. Long live the lock icon!

great solution
thanks!

Interestingly, in my case of Linux Mint 18.3, the lock icon does change the Wi-Fi icon when I have Use this connection only for resources on its network unchecked. When it's checked, the icon doesn't change.

To see the status of your VPN connection and automatically reconnect to the VPN when it drops, you can use the vpnLookOut applet: https://cinnamon-spices.linuxmint.com/applets/view/305

No matter what I tried, the lock icon does not appear. I guess this issue is still live.

Same for me, on Linux Mint 19 Cinnamon. When Use this connection only for resources on its network unchecked - shows the lock, when I try to route only part through vpn, check the above mentioned, it does not show the lock

Shouldn't this be a priority? Because the fact is the Nm Applet has so many issues... Can we fix the applet for a better experience?

Well, can we expect it to be fixed? It is really annoying (((

From what I can see in the code, the icon matches the main connection only.
See the _updateIcon function: https://github.com/linuxmint/Cinnamon/blob/master/files/usr/share/cinnamon/applets/network@cinnamon.org/applet.js

That's why the "lock" icon shows up only when Use this connection only for resources on its network is unchecked.

The code should probably be changed to take all the active connections into consideration (show an overlay "lock" icon, if a VPN connection is active, but it's not the main one)
Maybe @mtwebster can help with that.

Will this ever be fixed? It's annoying.

Really hope to see the fix soon. Like vpn is getting more and more used these days

A quick solution would be to insert the following code after the line 2294 https://github.com/linuxmint/Cinnamon/blob/master/files/usr/share/cinnamon/applets/network@cinnamon.org/applet.js#L2294 just after the code that updates an icon for the main connection:

for (let i = 0; i < this._activeConnections.length; i++) {
	let a = this._activeConnections[i];
	if (a.state == NM.ActiveConnectionState.ACTIVATING && a._section == NMConnectionCategory.VPN) {
		this._setIcon('network-vpn-acquiring');
		this.set_applet_tooltip(_("Connecting to the VPN..."));
	}
	else if (a.state == NM.ActiveConnectionState.ACTIVATED && a._section == NMConnectionCategory.VPN) {
		this._setIcon('network-vpn');
		this.set_applet_tooltip(_("Connected to the VPN"));
	}
}

It overrides the main icon state if there is a VPN among active connection and the network icon changes to lock if a VPN is active. It has solved the issue for me and I'd submit a PR but I'm not sure if this is a proper solution for everyone.
Thanks to @ediTLJ for pointing to the right place.

Another question: can an applet display a second icon in the tray? If yes, could someone point me to docs or code example?

Somehow disappointing that this is not solved yet. "Lock" icon shows up only when "Use this connection only for resources on its network" is unchecked in OpenVPN NetworkManager using Cinnamon 4.8.6.

IMHO this isn't a bug but a feature, why would the icon shows up as "locked" when the afore mentioned option is checked? Your network traffic is partially encrypted so the icon is showing the right state.

IMHO this isn't a bug but a feature, why would the icon shows up as "locked" when the afore mentioned option is checked? Your network traffic is partially encrypted so the icon is showing the right state.

Well, the other DEs (Gnome, MATE, XFCE, etc.) don't have this... feature :)
We need a way to know a VPN is up... another icon can be used, if you consider the "lock" one misleading.

The lock should indicate an established VPN connection, I think.
An existing VPN connection is a VPN connection even if being used exclusively for resources on its network.

So this is a bug in Cinnamon, I think.

The lock should indicate an established VPN connection, I think. An existing VPN connection is a VPN connection even if being used exclusively for resources on its network.

So this is a bug in Cinnamon, I think.

Totally agree. It shall show when vpn connection is up and running. The exact settings of vpn does not matter in this case

My question still stands: is it possible to display the 2-nd Network Manager icon in the tray or add some overlay? It would solve the problem. I'm using the modified patch from above to monitor VPN status but I'd like to still see the network status icon as well.

Check VPN Look-Out Applet - does something similar.

Check VPN Look-Out Applet - does something similar.

Hey, thanks for this great walk around. I'll stick to it for a while