---
title: 'Tutorial: Create Connection Profiles'
canonical: https://openvpn.net/as-docs/tutorials/tutorial--create-connection-profiles/
product: Access Server Docs
description: How to create connection profiles, .ovpn files, for a VPN client to connect with Access Server.
---

# Tutorial: Create Connection Profiles

## Overview

Connection profiles (.ovpn text files) contain the directives, parameters, and certificates required to establish the client-server VPN connection. These commonly include addresses and ports to contact the server, information for verifying peer identity, securing the TLS control channel, and other settings.

With our Access Server product, we recommend using connection profiles that bundle all necessary information into a single file. This works well with almost all OpenVPN clients, particularly our client software, OpenVPN Connect. For some open-source-based OpenVPN clients, splitting out the certificates and keys from the connection profile may be necessary. We provide the necessary tools and information to facilitate this process.

Refer to our [Connection Profiles topic](https://openvpn.net/as-docs/connection-profiles.md) for detailed information about connection profile types.

This tutorial describes how to create connection profiles using the command-line interface (CLI) or from the Admin Web UI.

Refer to [Tutorial: Create OpenVPN Connect Bundled Installers](https://openvpn.net/as-docs/tutorials/tutorial--create-openvpn-connect-installers.md) to create OpenVPN Connect installers for Windows and macOS that come bundled with a connection profile right out of the box after installation.

Users can download connection profiles and OpenVPN Connect bundled installers themselves. Refer to [Tutorial: Download OpenVPN Connect and Connection Profiles from the Client Web UI](https://openvpn.net/as-docs/tutorials/tutorial--download-from-client-web-ui.md).

## Prerequisites

- An installed Access Server.
- Admin Web UI access or console access with root privileges.
- Configured users.

## Option 1: Create connection profiles using the CLI

You can create connection profiles and the separated certificate and configuration files via the CLI. These files can be generated as single files containing all necessary information or as a set of separate files that must be used together.

1. Connect to the console and get root privileges.
2. Switch to the scripts directory:

   ```
   cd /usr/local/openvpn_as/scripts/
   ```
3. Use these commands to create connection profiles:
   - Save a server-locked profile to **client.ovpn**:

     ```
     ./sacli --prefer-tls-crypt-v2 GetGeneric >client.ovpn
     ```
   - Save a user-locked profile to **client.ovpn**:

     ```
     ./sacli --prefer-tls-crypt-v2 --user <USER_NAME> GetUserlogin >client.ovpn
     ```
   - Save an auto-login type profile to **client.ovpn**:

     ```
     ./sacli --prefer-tls-crypt-v2 --user <USER_NAME> GetAutologin >client.ovpn
     ```
   - Save a separate file versions of a user-locked profile:

     ```
     ./sacli --prefer-tls-crypt-v2 -o ./ --user <USER_NAME> GetUserlogin5
     ```
   - Save separate file versions of an auto-login profile:

     ```
     ./sacli --prefer-tls-crypt-v2 -o ./ --user <USER_NAME> GetAutologin5
     ```

   > **Note**
   >
   > - Access Server 2.9 or newer supports TLS Crypt v2. If you use an older Access Server or do not wish to use TLS Crypt v2, please omit the --prefer-tls-crypt-v2 flag.
   > - Autologin profiles require that the user has autologin permission, whether granted directly or inherited. By default, autologin permission is denied.
   > - Enclosing usernames in double quotes (") is recommended, particularly when they contain spaces.
   > - For **GetUserLogin5** and **GetAutologin5** the output directory can be specified with the -o parameter (./ is current directory).
   > - In ePKI mode, the commands `sacli GetGeneric` and `sacli GetUserlogin` will generate an **epki-generic** profile, while `sacli GetAutologin` will generate an **epki-autologin** profile. Ensure you use the appropriate command based on your desired profile type.

### More information on separate files

The commands **GetGeneric**, **GetUserlogin**, and **GetAutologin** generate a single client.ovpn file that contains all necessary connection information, certificates, and keys. For certain applications, separate files may be necessary. The **GetUserlogin5** and **GetAutlogin5** functions output several separate files. Depending on your TLS control channel configuration, the last two files in the overview below may not be needed or even present.

- **client.ovpn** — OpenVPN connection profile
- **ca.crt** — server CA certificate
- **client .crt** — client certificate
- **client.key** — client private key
- **ta.key** — TLS control channel key (tls-auth or tls-crypt-v1)
- **tls\_crypt\_v2.key** — TLS control channel key (tls-crypt-v2)

## Option 2: Create connection profiles using the Admin Web UI

1. Sign in to the Admin Web UI.
2. Click **User Management \> User Profiles**.
3. Click **New Profile** for the specific user.
4. Select **User-Locked** or **Autologin** (if available).

   > **Tip**
   >
   > To create an auto-login connection profile, you must enable **Allow Auto-login** for the user in **User Permissions**.
5. Add an optional comment and click **Create Profile**.
   - The file downloads to your machine.

---

Prev: [Connection Profiles and Token URLs](https://openvpn.net/as-docs/tutorials/connection-profiles-and-token-urls.md)
Next: [Tutorial: Create OpenVPN Connect Bundled Installers](https://openvpn.net/as-docs/tutorials/tutorial--create-openvpn-connect-installers.md)
Index: https://openvpn.net/as-docs/llms.txt