---
title: 'Tutorial: Update Your Access Server Version'
canonical: https://openvpn.net/as-docs/tutorials/tutorial--update-access-server/
product: Access Server Docs
description: How to keep Access Server updated to the latest version. We recommend running the latest version for best security practices.
---

# Tutorial: Update Your Access Server Version

## Overview

This tutorial guides you through updating Access Server to the latest version. While the easiest and most effective way to update is by using the installation script provided on the [Access Server portal](https://as-portal.openvpn.com/instructions), you can also upgrade using other methods, such as package managers.

If you prefer not to use the installation script, you can upgrade Access Server manually by using `apt` or `yum`. However, keep in mind that you will need to ensure that any held packages are handled properly during the process.

For a related resource, we have a video that shows you [how to update Access Server to the latest version](https://openvpn.net/as-docs/videos/video--update-as.md).

## Before you begin

### Backup your settings

Use [these backup commands on the command line](https://openvpn.net/as-docs/tutorials/tutorial--configuration-backup.md) to completely back up your settings without stopping your server. The information stored in Access Server (e.g., server and client certificates) is unique and cannot be replaced. We recommend setting up automated backup tasks if you haven't already done so.

### Check server compatibility

The current version of Access Server is very compatible with past versions. You can update versions as described here back to 1.7.1. If needed, Access Server leaves a copy of old data in this directory whenever you upgrade: **/usr/local/openvpn\_as/etc/backup**.

| **Distribution** | **Version** |
| --- | --- |
| Ubuntu\* | 26.04 LTS (x86\_64 and ARM64) 24.04 LTS (x86\_64 and ARM64) 22.04 LTS (x86\_64 and ARM64) |
| Debian | 13 12 |
| Red Hat Enterprise Linux | 10 9 8 |

> **Note**
>
> \*For Ubuntu, we only support long-term support (LTS) releases.

### Check client compatibility

Some cases may exist where older client software can't connect to a modern Access Server. To fix this, update to a more recent client software version. If that isn't possible, you may lower Access Server's security requirements. It may be that an upgraded Access Server has the minimum required TLS security level set to a higher version, causing an issue with older clients. You can change this for your server:

1. Sign in to the Admin Web UI.
2. Select **Configuration → TLS Settings**.
3. Set the **OpenVPN daemons** to TLS 1.0.
4. Select **Save Settings** and **Update Running Server**.

### Understand Amazon AWS tiered instance licensing

If you have an Amazon AWS tiered instance pre-licensed with “xx connected devices,” you don’t need to worry about licenses. Amazon’s licensing and billing systems take care of them internally. Simply upgrade the Access Server package itself.

## Step 1: Get the installation script

> **Tip**
>
> We highly recommend using the **installation script** from the Access Server portal for a smooth and automated update process. The script automatically handles any dependencies and potential issues like held packages.

1. Sign in to the [Access Server Portal](https://as-portal.openvpn.com/).
2. Select **Install Access Server**.
3. Copy the bash install command.

## Step 2: Run the installation script on your server

1. Connect to your Access Server console however you prefer: bash, SSH, PuTTY, etc.
2. Gain root privileges. For example:

   ```
   sudo su
   ```
3. Paste the bash command and run it.
   - "Welcome to the OpenVPN Access Server Installation Script!" displays and starts the installation.
   - The script detects your Linux distribution and Access Server version.
   - If the current installation is pinned, the script temporarily ignores that and upgrades anyway. After this, the **openvpn-as** package is pinned again.
   - After the **openvpn-as** package upgrades, the script checks for [OpenVPN DCO](https://openvpn.net/as-docs/openvpn-data-channel-offload.md) and installs or upgrades as necessary.

     > **Tip**
     >
     > Refer to [Tutorial: Turn on OpenVPN DCO in Access Server](https://openvpn.net/as-docs/tutorials/tutorial--turn-on-openvpn-dco.md) for more about performance improvements with OpenVPN DCO.
4. Wait for the script to complete.
5. After the upgrade, reboot the server to apply the new version:

   ```
   reboot
   ```

   - If all went well, your Access Server and your Linux system are now up to date.

> **Tip**
>
> We provide detailed installation guides for the different platforms available. Refer to these [installation guides](https://openvpn.net/as-docs/installation.md) for steps.

## Option: Upgrade using package manager (apt/yum)

If you prefer using the Linux package manager (`apt` for Debian/Ubuntu or `yum` for RHEL), you can manually upgrade the package with these steps:

1. **Check for package locking:** Ensure the package isn't **held** in the package manager. If the package is held, using the following commands to unhold it:
   - **Ubuntu and Debian**

     ```
     apt-mark unhold openvpn-as
     ```
   - **Red Hat Enterpise Linux**

     ```
     yum versionlock openvpn-as
     ```
2. **Update the system:** Run the following commands to update your system:
   - **Ubuntu and Debian**

     ```
     sudo apt update && sudo apt upgrade
     ```
   - **Red Hat Enterprise Linux**

     ```
     sudo yum check-update && sudo yum update
     ```

     > **Tip**
     >
     > These commands update packages within the version of your operating system. If your Access Server uses our software repository, it will also upgrade the Access Server and bundled OpenVPN Connect apps if there are newer versions.
     >
     > These commands will not upgrade your Linux OS, such as from Ubuntu 18.04 LTS to Ubuntu 20.04 LTS. Such a large upgrade is called a distribution upgrade. Refer to [Tutorial: How to Migrate an Access Server Installation](https://openvpn.net/as-docs/tutorials/tutorial--migrating-access-server.md).
     >
     > If you use a fixed license key, a distribution upgrade could break it. [Contact us for help](https://support.openvpn.com/).
3. After completing the upgrade, reboot the server:

   ```
   reboot
   ```

## Preventing Access Server updates

Once you have added the Access Server software repository to your system, any time you run the commands to update your operating system, it will also pull in the new Access Server release and bundled connect clients, if there are any. For cloud images (Google, Azure, AWS, and DigitalOcean), ESXi, and HyperV appliances, we have pinned the **openvpn-as** package so that the Access Server program doesn't update when you install operating system updates.

We have done this to avoid a sudden change in process. Past versions of Access Server stayed at their currently installed version number when people ran operating system updates. We did not want to surprise a system administrator with a new Access Server version just by performing security updates.

You can change that by unpinning it, and repin if you’d like with these commands.

1. Unpin the **openvpn-as** package:

   ```
   apt-mark unhold openvpn-as
   ```
2. Repin the **openvpn-as** package:

   ```
   apt-mark hold openvpn-as
   ```

If you use our official installation script to perform an update of the Access Server, the script will detect if the **openvpn-as** package is on hold or not:

- If the package is marked **hold**, the script will unpin it and proceed with the update. Once the update is finished, it will put the **openvpn-as** package on **hold** again.
- If the package is marked **unhold**, the script will proceed with the update. Once the update is finished, it will put the **openvpn-as** package on **hold**.

## Option: Upgrade Access Servers in a cluster setup

An Access Server cluster relies on a central database system to store user, certificate, and configuration information. Some settings, such as which interface to listen on and how to connect to the central database, are configured locally on each cluster node. This section walks you through upgrading an Access Server cluster using a rolling upgrade to minimize downtime.

### Before you begin

1. Back up your data, both the central and local databases:
   1. Use the `mysqldump` tool to create a backup of the data in the cluster's central database. This ensures you have a copy of critical data in case of an issue during the upgrade.
   2. After backing up the central database, back up the local configuration stored in the `config_local.db` file on each node. Refer to [How to Back Up Access Server Configuration](https://openvpn.net/as-docs/v3/tutorials/tutorial--configuration-backup.md).
2. Ensure version consistency. All nodes need to run on the same version. As you upgrade, all nodes need to eventually match the same new version.

   > **Note**
   >
   > If you are upgrading from a significantly older version (for example, version 2.8.8 or earlier), we recommend stopping the service on all nodes before proceeding.

### Steps for a rolling upgrade

A rolling upgrade updates nodes one at a time, so the cluster is never fully offline. Clients connected to the node being upgraded may briefly disconnect, but should automatically reconnect to another node if your cluster uses round-robin DNS (RRDNS) and a shared hostname. Without this setup, reconnect attempts may fail or take longer.

This example walks through upgrading a two-node cluster.

1. Begin upgrading your Access Server nodes one by one. This is called a **rolling upgrade**, and it ensures the entire cluster is never fully down.
2. Upgrade the first node to the new version.
   - During this process, clients connected to the node being upgraded may experience temporary disconnects but should automatically reconnect to the next available node.
3. Repeat this process for each node in your cluster.
   - Verify that all nodes are correctly upgraded and functioning as expected.

#### Step 1: Upgrade Node1

1. Connect to the Node1 console and get root privileges.
2. Upgrade Access Server using your preferred method. To upgrade using our installation script, refer to **Step 1: Get the installation script** above. To upgrade using the package manager:
   - Ubuntu/Debian:

     ```
     apt update && apt -y install openvpn-as
     ```
   - Red Hat Enterprise Linux:

     ```
     yum -y install openvpn-as
     ```

     > **Note**
     >
     > The `openvpnas` service starts automatically after the upgrade completes.
3. Verify that Node1 is functioning properly before continuing.

#### Step 2: Upgrade Node2

1. Connect to the Node2 console and get root privileges.
2. Upgrade Access Server using your preferred method, as in step 2.

   > **Note**
   >
   > The `openvpnas` server starts automatically after the upgrade completes. You don't need to manually restart it.

### Test connectivity

1. Verify that the cluster functions as expected and clients can connect and use services without issues.

## Option: Upgrade a failover setup

> **Warning**
>
> Before you begin, ensure that you back up the main node in the master state. Use these [backup commands on the command line](https://openvpn.net/as-docs/tutorials/tutorial--configuration-backup.md).

Access Server has a built-in failover mode you can deploy on your local LAN network. It allows one primary node to handle all tasks, with a secondary standby node. The secondary node comes online automatically, taking over all tasks if your primary node fails. This is done using a method called UCARP, which uses VRRP heartbeat network packets. For more details, refer to [Tutorial: How To Set Up Failover Mode](https://openvpn.net/as-docs/tutorials/tutorial--failover.md).

> **Important**
>
> Keep both Access Server nodes updated with the same versions. We also recommend following a specific upgrade procedure to avoid triggering the failover unnecessarily. This should also ensure that you can easily restore connectivity if anything goes wrong with the upgrade.

1. Use the following command to determine the active node for making a backup:

   ```
   grep "Switching to state:" /var/log/openvpnas.log |tail -n1
   ```

   - If you see`[WARNING] Switching to state: MASTER` — you are on the active node. Make your backup here.
   - If you see `[WARNING] Switching to state: BACKUP` — you are on the standby node. Go to the other node and re-check if it's active.

     > **Note**
     >
     > In our example, the primary node is MASTER and the secondary node is BACKUP.
2. Shut down the (virtual) machine that is acting as BACKUP. In our case, this is the secondary node.
3. Stop the primary node's Access Server service:

   ```
   systemctl stop openvpnas
   ```
4. Upgrade the software on the primary node.
   - To upgrade using our installation script, refer to **Step 1: Get the installation script** above.
   - To upgrade using the package installer, refer to **Option: Upgrade using package manager (apt/yum)** above.
5. Validate everything works on your updated primary node. Access Server should have started automatically after the upgrade, but if it didn't, run `systemctl start openvpnas`.
6. After testing the primary node, bring the failover node online and perform the same upgrade steps.

   > **Note**
   >
   > The failover node won't actually do anything while the primary node is online, so you can now safely upgrade it to the latest version.
7. After completing the failover node upgrade, wait ten minutes for a configuration update from your primary node before testing the failover functionality.
   - At a reasonable time, we recommend testing to see if the failover system is working correctly. To do this, take the primary node down and check to see that your connections and Admin Web UI work as expected.

> **Tip**
>
> If something goes wrong with the upgrade process of the primary node, we recommend that you gather log file information and contact us through our support ticket system. Then, take the primary node offline. Once it is offline, bring the failover node online. It should start up as the old system it was and take over and handle connections. This keeps your clients up and running while you look into the problem on the primary node. Once issues are diagnosed and resolved, you can bring the primary node back up, take the failover node offline, and perform the upgrade steps outlined above.

## Option: Rolling back to a previous version

> **Important**
>
> We recommend [contacting support](https://support.openvpn.com/hc/en-us) if you need to roll back due to difficulties. We can help out.

When Access Server detects an older version of its databases, it may automatically update them during startup. In cluster setups, this also affects the central databases. These updates occasionally cause incompatibilities with older Access Server versions if you need to roll back.

### Steps to roll back and restore databases:

> **Important**
>
> Use the steps below for SQLite 3 as the database backend.
>
> If you're using MySQL, only the last step — using a backup tool like `mysqldump` — applies to you.

1. Always create a [backup](https://openvpn.net/as-docs/tutorials/tutorial--downgrade.md) of the local and central databases before upgrading.
2. If you roll back to an older version of Access Server, [restore the databases](https://openvpn.net/as-docs/tutorials/tutorial--downgrade.md) from the backup created before the upgrade.
3. Use your backup tools (such as `mysqldump`) to restore the central and local databases to their pre-upgrade state.

### Downgrade Access Server

We recommend running the latest version, but if you need to downgrade to an older version, refer to this tutorial:

- [Tutorial: Downgrade Access Server](https://openvpn.net/as-docs/tutorials/tutorial--downgrade.md)

## Option: Replace the entire appliance or cloud image

If your appliance or cloud image is outdated or your system runs on an unsupported operating system, we recommend installing a fresh Access Server version. Here's how you can perform the migration or reinstallation:

1. Follow the [Tutorial: How to Migrate an Access Server Installation](https://openvpn.net/as-docs/tutorials/tutorial--migrating-access-server.md) to back up your system and configuration files, including all settings and your subscription license.
2. Install a new Linux OS and Access Server on a separate system while keeping your old system running.
3. Once the new system is set up, [restore](https://openvpn.net/as-docs/v3/tutorials/tutorial--migrate-aws-tiered-to-subscription/#step-3--restore-access-server-data-260244) your configuration, data, and subscription license from the backup to the new Access Server.
4. Before switching to the new server, test it out.
5. Finally, switch to the new system and decommission the old server.

## Service Notice: Perpetual license keys

If you have a perpetual license key purchased prior to 2013, you must purchase a new subscription to upgrade your Access Server instance. All Access Server license keys purchased since 2013 are standard license keys, not perpetual.

OpenVPN strictly adheres to the original terms under which we sold perpetual licenses. One of those terms was that neither support nor upgrades were allowed when the license key’s support term expired. A perpetual license key will not work on an Access Server higher than version 1.8.4.

## Frequently Asked Questions

### Does upgrading create downtime?

Yes, upgrading Access Server requires restarting the service, but the downtime is typically brief, lasting only a few minutes. After the upgrade, VPN clients should automatically reconnect.

For minimal disruption, we recommend performing upgrades during off-peak hours, such as nights or weekends.

Alternatively, you can set up a new server alongside the old one, [migrate the configuration](https://openvpn.net/as-docs/tutorials/tutorial--migrating-access-server.md), and test it before making the switch. This approach minimizes downtime to just a few minutes.

### What do I do if my operating system is no longer supported?

If you're using an unsupported operating system, we recommend setting up a new server with a supported OS and migrating your Access Server configuration to it. When we drop support for an OS, it's typically because the OS maintainers have also ended support, leaving it vulnerable to security issues that will not be resolved.

Migrating your configuration to a new server ensures that your VPN client settings remain intact. You can swap out the old server for the new one, allowing you to continue business as usual without disruption.

For detailed steps on migrating your Access Server configuration, refer to our [migration guide](https://openvpn.net/as-docs/tutorials/tutorial--migrating-access-server.md).

### Will I lose my fixed license key if I upgrade?

No, fixed license keys are retained when upgrading on the same server.

If your upgrade involves setting up a new server, and you're using a fixed license key, you will need to contact us to have your key reissued. This process is free and can be done via our [support ticket system](https://support.openvpn.com/hc/en-us/requests/new).

With a subscription plan, there is no need for reissuance. Subscriptions can be activated on as many servers as needed, providing more flexibility for your installations.

### Will I lose important information or features?

No, you will not lose any important information. The upgrade retains all configuration settings, ensuring that VPN clients can reconnect and maintain their settings without disruption.

It is unlikely that you will lose important features. You can review the [Access Server release notes](https://openvpn.net/as-docs/release-notes.md) for any deprecated features. While it's uncommon for us to remove features, we recommend setting up a new server alongside the old one for testing before upgrading or replacing the old server to ensure the upgrade doesn't impact any critical functionalities.

### My current version (though outdated) works fine. Why should I upgrade?

Although your current version may be working fine, it's crucial to keep Access Server up to date to maintain optimal security and performance. Security vulnerabilities can emerge over time, and updates often include patches that protect against threats. Staying current ensures that you avoid risks and maintain a secure, reliable VPN solution.

### The employee who set up Access Server is no longer with us. What do we do?

If you're unsure how to upgrade or manage Access Server, we recommend engaging an IT networking specialist or a new employee with the necessary skills and expertise. Alternatively, you can switch to our [CloudConnexa solution](https://openvpn.net/cloud-vpn/), which provides secure connectivity without the need to maintain a dedicated server.

Regardless of your solution, it's essential to keep your network's access point up to date to maintain security. While Access Server is highly secure, neglecting updates over time introduces potential risks.

### Our IT Admin isn’t sure how to perform regular maintenance. How do we upgrade?

We provide this comprehensive upgrade guide that walks you through the entire process. If your current IT admin is not familiar with performing these tasks, we recommend training on Linux system maintenance, or alternatively, you can explore our [CloudConnexa solution](https://openvpn.net/cloud-vpn/). CloudConnexa allows you to securely connect systems without the need to manage your own VPN server.

### Will I break my Access Server?

It is highly unlikely, but in some rare cases, issues may arise. Since the security landscape evolves, if your last upgrade was a long time ago, some components may have become incompatible.

We maintain a software repository with versions going back to 2.7.5, so if needed, you can easily [roll back to a previous version](https://openvpn.net/as-docs/tutorials/tutorial--downgrade.md).

For added assurance, we recommend setting up a new server alongside the existing one, [migrating your data](https://openvpn.net/as-docs/tutorials/tutorial--migrating-access-server.md), and conducting tests while the old server remains active. Once you're confident that everything is working correctly, you can proceed with the upgrade or switch the old server with the new one.

### What if I need to downgrade to an older version?

We don’t recommend downgrading Access Server to an earlier version unless it's absolutely necessary. Using the latest version ensures that you have the most up-to-date bug fixes and security patches.

If you do need to revert to an older version, please refer to our [Access Server downgrade tutorial](https://openvpn.net/as-docs/tutorials/tutorial--downgrade.md) for detailed instructions.

---

Prev: [Upgrades, Migrations, and Maintenance](https://openvpn.net/as-docs/tutorials/upgrades-migrations-and-maintenance.md)
Next: [Tutorial: Upgrade the Access Server Docker Image](https://openvpn.net/as-docs/tutorials/tutorial--upgrade-docker-image.md)
Index: https://openvpn.net/as-docs/llms.txt