There are too few details and context known here. What do you mean with "connect to the server in a safer way": what kind of communication happens and what to protect it from? Why do you want a network level protection (VPN) to protect a (seemingly?) application communication in the first place instead of using application level protection like TLS?

I don't have access to the programming code and I can't add the TLS protocol in the application. The program connect by mysql and FTP the unsafe way, it's a horror...

It's a bit more clear what problem you face, but your task in solving it is still unclear. Are your responsible to roll out an external application at your site, with clients and server in your control? Do you only control the server and need to make external clients use it, without having access to their computer, ... something else?

You say "I can't control their security" but then you are talking about "install the VPN keys in their computers" ... so, can you control there security or can you not? If this is a company and you can tell your fellow employees to use a VPN or SSH tunnel to access this, that would prob be a good idea. If these are random customers and you have no right to tell them to use a vpn or ssh ... you really dont have any options. "Installing VPN keys" isnt really going to fix anything if the users dont make use of the VPN.

@SteffenUllrich The application is already deployed, it uses FTP and Sql connection to connect with the external server (Java jdbc). The clients are the employees of my company, they use this application for the internal tasks of the company, but they can install the app in their personal computers as well. I control the server completely. I can access to the sql server and ftp server

@CaffeineAddiction I wanted to say that I can't the security of their personal computers because they can install malware without knowing it. Can the malware steal the public VPN key and access to my server? Sorry for my ignorance. I can install VPN or SSH tunnel in their computer but I don't know is dangerous if the malwares steals the keys.

@Arkhan6: If you allow your employees to use their own computers to connect to your network you have more problems than stealing the VPN key. First it is likely possible. Second it might not even be necessary because an attacker should just use the compromised personal device of the employee as a jumphost into your network, i.e. make use of the established VPN.

Can malware steal just about anything (including vpn keys) on a box in which it is running ... in theory yes. Is it likely it is set to automatically do this and/or are the "hackers" on the other end setup to take this info and pivot ... prob not (based upon your security profile and what you currently have as a setup). Is relying on this boardering on security through obscurity (which isnt secure at all) ... pretty much.

@SteffenUllrich OK I was searching information about that but I wasn't completely clear. So If I could use TLS/SSL would it be better? Btw, with the SSH tunnel has the same problem that the VPN?

@CaffeineAddiction Oh, ok, I get you. Do you recommend me another option to be able to connect in a secure way?

@Arkhan6: No kind of VPN, SSH tunnel, TLS ... will make a compromised device secure. These technologies just protect the communication against interception and modification. They don't make sure that only "harmless" communication is done.

@SteffenUllrich It's sound that the best option is develop the application again in web app and use the protocol https

@Arkhan6: This will not protect against a compromised personal device either. If you do online banking through a browser they also expect you to use a secured device since they cannot ensure security of the banking if your device is compromised.

So what security do the keys give me if they don't allow me to connect safely without being compromised?

As @Arkhan6 stated "VPN, SSH tunnel, TLS ... just protect the communication against interception and modification". They do not protect either end of the connection ... just the connection and the data xfered from outside forces. Getting the key compromised on the client side is outside the scope of the tunneling software.

@CaffeineAddiction So, we can update desktop apps or download file like in Telegram or other programs, How they protect the connection of the program with their servers? I do not know if I'm explaining myself well

@Arkhan6: You have two issues here: 1. protect the communication with the servers against someone in the communication path. This can be done with VPN, SSH tunnel, TLS ... . 2. make sure that the client which talks to the server isn't malicious: this cannot be solved by some kind of tunnel, TLS ... . browsers, Telegram, ... only care about (1) and simply assume that the client device is not compromised (2). How much do you trust your employees to keep their system sufficiently safe?

@SteffenUllrich: But I have a doubt. If the malware steal de public key that connect with the telegram servers, Can the attackers enter Telegram servers? (I don't think so). They have to have methods to protect about that problem. You said "simply assume that the client device is not compromised", hundreds of thousands of people use Telegram in their personal computer and I am sure that a lot of people have their computer infected with malware.

@Arkhan6: "Can the attackers enter Telegram servers?" - They likely have some kind of protection against attacks by malicious clients - but this kind protection is not achieved by transport encryption. "I am sure that a lot of people have their computer infected with malware." - I agree with this statement but I don't agree with your conclusion that these users will be "somehow" protected from the attacker. Security is neither achieved by magic nor by wishful thinking. And a compromised system with an authenticated Telegram account on it should be considered a compromised Telegram account.

@SteffenUllrich Ok, I get you :). "a public key does not provide any protection by itself and needs not to be protected against "stealing" - it's "public"" I thought that those keys could only be used by server administrators. So I understand that it's normal use a public key in an dekstop app to connect with the servers. I've seen that I can integrate the public key inside the coding programming for more protection.