Tutorial: Extract Separate Certificate Files for a User⁠

Overview⁠

Connection profiles (.ovpn text files) contain the directives, parameters, and certificates required to establish the server-client connection. This typically includes addresses and ports to contact the server, information verifying the server's identity, securing the TLS control channel, and other relevant settings. An OpenVPN client requires this information to connect to an OpenVPN server.

With our Access Server product, we recommend using connection profiles that bundle all necessary information into a single file. This works well with almost all OpenVPN clients, particularly OpenVPN Connect. For some open-source-based OpenVPN clients, splitting out the certificates and keys from the connection profile may be necessary.

Follow this tutorial to extract the certificates and keys from the connection profile.

Switch to the scripts directory:
```
cd /usr/local/openvpn_as/scripts/
```
Create a subfolder separate:
```
mkdir ./separate
```
Save a separate files version of a user-locked profile:
```
./sacli --prefer-tls-crypt-v2 -o ./separate --user "test-client" GetUserlogin5
```
Or save a separate viles version of an auto-login profile:
```
./sacli --prefer-tls-crypt-v2 -o ./separate --user "test-client" GetAutologin5
```
Note
- The files will be saved in the /usr/local/openvpn_as/scripts/separate/ directory and can be found there.
- Access Server 2.9 or newer supports TLS Crypt v2. If you use an older Access Server or do not wish to use TLS Crypt v2, please omit the --prefer-tls-crypt-v2 flag.
- Autologin profiles require the user to have autologin permission, whether granted directly or inherited. By default, autologin permission is denied.
- We recommend enclosing usernames in double-quotes ("), particularly when they contain spaces.
- For GetUserLogin5 and GetAutologin5, you can specify the output directory with the -o parameter (./separate in the example).

More information on separate files⁠

The GetUserlogin5 and GetAutlogin5 functions output several separate files. Depending on your TLS control channel configuration, the last two files in the overview below may not be needed or even present.

client.ovpn — OpenVPN connection profile
ca.crt — server CA certificate
client.crt — client certificate
client.key — client private key
ta.key — TLS control channel key (TLS Auth or TLS Crypt)
tls_crypt_v2.key — TLS control channel key (TLS Crypt v2)

Now that you have separate files, you need to transfer them to the local computer. If you’re using Linux or macOS, you can use scp to copy the files. The steps below are for Windows users.

Here are the steps for transferring the files using WinSCP:

Start WinSCP and click Session.
Enter the server’s address, username, and password.
Select SCP under File protocol.
Click Login.
Once connected, click the Open folder icon for the server and open /usr/local/openvpn_as/scripts/separate/.
Select the files from the …/separate/ folder on the server to drag and drop them to a folder on your computer in the left pane.
- You should now have the separate files saved to your computer for your use.

Can't find what you're looking for?

Our support team will be happy to assist you.

Contact Support Schedule a Demo

Tutorial: Extract Separate Certificate Files for a User⁠

Overview⁠

Was this information helpful?