---
title: 'Quick Start: Deploy Access Server with Access Server Link'
canonical: https://openvpn.net/as-docs/v3/access-server-link/
product: Access Server Docs
description: Learn how to use Access Server Link in OpenVPN Access Server 3.2.0 to automate DNS, SSL, and remote access with a secure hostname and centralized management.
---

# Quick Start: Deploy Access Server with Access Server Link

## Overview

**Access Server Link** is a feature introduced in Access Server 3.2.0 that simplifies the deployment and management of OpenVPN Access Server on AWS, Azure, and GCP. Instead of manually configuring DNS records and SSL certificates, Access Server Link automates these steps and provides a stable, trusted URL for accessing your Admin and Client Web UI from day one.

**Access Server Link benefits:**

- A free, secure hostname (example: `yourcompany.openvpn.com`) with an automated SSL certificate — no manual SSL certificate setup required afterward.
- A central place in the [Access Server Hub](https://openvpn.net/as-docs/v3/tutorials/access-server-portal-account.md) to manage subscriptions and deployments.
- Automatic DNS record updates if your server's public IP address changes.
- Automatic reporting and status monitoring of your Access Server.

> **Note**
>
> VPN traffic isn't proxied through Access Server Link. VPN connections go directly to your Access Server via a separate VPN DNS record (example: `def456.access-server.cloud`).

## Prerequisites

- Access Server 3.2.0 or newer.
- An active OpenVPN account. Create one if you don't have one yet.
- An active account in one of the supported cloud providers: **AWS**, **Azure**, or **GCP**.

## 🔑 Purchase a subscription

1. Sign in to your [OpenVPN account](https://myaccount.openvpn.com/signin/as) and navigate to the Access Server product.
2. Select one of the following:
   - **Start 14-Day Free Trial:** Enter the number of VPN connections you want (default is 10), provide billing information, and complete the trial setup. Billing begins after the 14-day trial ends.
   - **Try Free Version:** A free subscription with two VPN connections is created automatically. No billing information is required.
   - **Existing subscription:** Click **Activation Keys** to purchase an additional subscription or use an existing one.

## 📜 Claim your hostname in the Access Server Hub

1. In the Access Server Hub, click **Installation** in the left panel.
2. Under **Launch faster With Access Server Link**, enter your desired hostname (`yourcompany`). This becomes your **Access Server Link URL** for the Admin and Client Web UI (example: `yourcompany.openvpn.com`).
3. Click **Create Hostname and Continue**.

   > **Note**
   >
   > Your hostname is reserved exclusively for your account once claimed. It can't be used by anyone else.
4. Under **Select A Cloud Service Provider**, **AWS**, **Azure**, or **GCP**, then follow the steps for your provider below.

## 🚀 Deploy on your cloud provider

### ⚙️ If you select AWS

1. Select the nearest AWS region from the drop-down.
2. Under **Set Your Credentials \> Password**, enter a password for the `openvpn` user. You'll use this to sign in to the Admin Web UI after deployment.
3. Click **Confirm and Deploy on AWS**.
   - You are directed to AWS CloudFormation.
4. Complete the **Quick create stack**:

   | **Field** | **Description** |
   | --- | --- |
   | **Stack name** | Name for your CloudFormation stack. Default: `openvpn-accessserver`. |
   | **ActivationKey** | Pre-populated with the AWS PAYG license key. |
   | **VpcId** | Select the VPC for your instance. |
   | **SubnetId** | Select a public subnet. |
   | **InstanceName** | Name for the instance. Default: `OpenVPNAccessServer`. |
   | **InstanceType** | Select an instance type. Default: `t3.small`. |
   | **KeyName** | Select an existing EC2 key pair for SSH access. |
5. Acknowledge that AWS CloudFormation will create IAM resources, then click **Create stack**.

#### 🖥️ Gather Admin Web UI info from stack output

> **Important**
>
> The system requires up to five minutes for complete initialization. Once initialization is complete, you can sign in successfully.

Once the stack completes, you can find your connection details for the [Admin Web UI](https://openvpn.net/as-docs/v3/admin-web-ui-3-0-user-manual.md) in the stack output.

Here's how to access the Admin Web UI after the stack is complete:

1. On the CloudFormation status page, click the **Outputs** tab. One output is displayed:
   - **AdminPortal:** The Access Server Link URL to access the Admin Web UI (Example: `https://yourcompany.openvpn.com/admin`).
2. Open your web browser and navigate to the Admin Web UI using the **AdminPortal** URL.
3. Enter the **username** (`openvpn`) and the **password** created in the previous steps.

### ⚙️ If you select Azure

1. Under **Set Your Credentials \> Password**, enter a password for the `openvpn` user. You'll use this to sign in to the Admin Web UI after deployment.
2. Click **Confirm and Deploy on Azure**.
   - You're directed to the Azure Custom deployment page.
3. Complete the **Custom deployment** form:

   | **Field** | **Description** |
   | --- | --- |
   | **Subscription** | Select the Azure subscription where you'll be billed. |
   | **Resource group** | Select an existing resource group where your instance, security groups, virtual networks, etc., will be deployed, or create a new one. |
   | **Region** | Select the nearest Azure region. |
   | **Virtual machine name** | Name for the instance. Default: `OpenVPNAccessServer`. |
   | **Virtual machine size** | Select a VM size. |
   | **Admin Username** | SSH username. Default: `azureuser`. |
   | **SSH public key source** | Select an existing key pair, or create one. |
   | **Virtual network** | Select your virtual network. |
   | **Subnet** | Select your subnet. |
4. Click **Review + create**.
5. Click **Create**.

#### 🖥️ Gather Admin Web UI info from deployment output

> **Important**
>
> The system requires up to five minutes for complete initialization. Once initialization is complete, you can sign in successfully.

Once the deployment completes, you can find your connection details for the [Admin Web UI](https://openvpn.net/as-docs/v3/admin-web-ui-3-0-user-manual.md) in the Outputs tab.

Here's how to access the Admin Web UI after the deployment is complete:

1. After the deployment is complete, click the **Outputs** tab. One output is displayed:
   - **adminPortal:** The Access Server Link URL to access the Admin Web UI (Example: `https://yourcompany.openvpn.com/admin`).
2. Open your web browser and navigate to the Admin Web UI using the **adminPortal** URL.
3. Enter the **username** (`openvpn`) and the **password** created in the previous steps.

### ⚙️ If you select GCP

1. Select the nearest GCP region from the drop-down.
2. Select your **Google Project ID**. Hover over the tooltip for help finding it.
3. Under **Set Your Credentials \> Password**, enter a password for the `openvpn` user. You'll use this to sign in to the Admin Web UI after deployment.
4. Click **Generate Deployment URL**, and the **Deployment URL** will be generated.
5. Copy the **Deployment URL** to your clipboard, and then click **Confirm and Deploy**.

   > **Important**
   >
   > Before proceeding, copy and save your **Deployment URL**, **Username**, and **Password** from the confirmation prompt.
6. Click **Continue to GCP**.
   - You're directed to Google Cloud Infrastructure Manager.
7. Complete the deployment form:

   | **Field** | **Description** |
   | --- | --- |
   | **Deployment ID** | A unique name for this deployment within your project. |
   | **Region** | Select the nearest GCP region. |
   | **Service account** | Select your service account. |
   | **Source of Terraform configuration** | Select **GCS**. |
   | **Source \*** | Paste the Deployment URL generated previously. |
8. Click **Continue**.
9. Click **Create deployment.**

#### 🖥️ Gather Admin Web UI info from deployment output

> **Important**
>
> The system requires up to five minutes for complete initialization. Once initialization is complete, you can sign in successfully.

Once the deployment completes, you can find your connection details for the [Admin Web UI](https://openvpn.net/as-docs/v3/admin-web-ui-3-0-user-manual.md) in the Outputs tab.

Here's how to access the Admin Web UI after the deployment is complete:

1. After the deployment is completed, click the **Outputs** tab. The following values are displayed:
   - **admin\_url:** The Access Server Link URL to access the Admin Web UI (Example: `https://yourcompany.openvpn.com/admin`).
   - **admin\_user:** Username (`openvpn`) to access the Admin Web UI.
   - **site\_url:** The Access Server Link URL to access the Client Web UI (Example: `https://yourcompany.openvpn.com/`).
2. Open your web browser and navigate to the Admin Web UI using the **admin\_url** URL.
3. Enter the **username** (`openvpn`) and the **password** created in the previous steps.

## ⚙️ How Access Server Link works

When Access Server Link is enabled, your Access Server sends the following information to the Access Server Link backend in its status report:

- Certificate Fingerprint
- Node URL
- Public IP address
- Linux hostname
- Admin Web UI Port

DNS records are kept up to date automatically. If your server's public IP address changes, the DNS record is updated within approximately 15-20 minutes.

The Admin and Client Web UI are reachable securely via your **Access Server Link URL** (`yourcompany.openvpn.com`), with identity verified by certificate fingerprint. VPN connections go directly to your Access Server via a separate VPN DNS record (example: `def456.access-server.cloud`). VPN traffic isn't proxied.

> **Note**
>
> The Node URL and VPN DNS Record follow this pattern: `[32 random characters].access-server.cloud`.

## 🖱️ Verify Access Server Link

After deployment, confirm that Access Server Link is active and reporting correctly.

### Status indicators

| Status | Meaning |
| --- | --- |
| 🟢 Operating normally | Everything is working correctly. |
| 🔴 Errors found | Access Server Link is enabled, but a required configuration value (node identifier or subscription) is missing. The server cannot report its status. |
| 🟡 Warnings found | Admin Web UI port and Client Web UI port are set to different values. The server is still reporting, but the proxy may only be able to reach the Admin Web UI. |

### From the Access Server Hub

1. Go to the Access Server Hub and refresh the page to update the **Access Server Link** Status.
2. Click **My Access Servers** in the left panel.
3. Confirm that **Server status** shows 🟢 **Online**.
4. Optionally, click **Open Admin Web UI** or **Open Client Web UI** to verify both are reachable.

From this page, you can see the following information:

Under **Subscription Details**:

1. You can click **Upgrade Subscription** if you want to scale up your Subscription.
2. **Subscription Name:** The name of your Subscription.
3. **Subscription ID:** Subscription identifier.
4. **Connections in use:** Number of VPN users connected to the Access Server.

Under **Overview**:

1. **Access Server URL:** This is the Access Server Link URL.
2. **Mode:** If you’re using Standalone or Cluster.
3. **Access Server version:** Current version of your Access Server.
4. **Operating system:** Access Server Linux operating system

Also, if you click **View Server Details**, you can see the following info:

1. **Node name:** Instance hostname.
2. **Status:** Access Server Link status.
3. **IP Address:** Public IP of your instance.
4. **Node URL:** Internal identifier used for API communication.
5. **Server ID:** Unique identifier for this deployment.
6. **Connections:** Number of VPN users connected to the Access Server.
7. **Last Seen:** The last time that the Access Server Link backend checks the Access Server node.

### From the Access Server Admin Web UI

1. Sign in to the Access Server Admin Web UI using the **Access Server Link URL**.
2. Go to **Web Services → Access Server Link**.
3. Confirm that **Access Server Link** is toggled **On**.
4. Check that the **Status** shows 🟢 **Operating normally**.

From there, you can also check under **Details**:

1. **Admin Web UI URL:** This is the Access Server Link URL used to log in to the Admin Web UI. Example: `https://yourcompany.openvpn.com/admin`
2. **Client Web UI URL:** This is the Access Server Link URL used to log in to the Client Web UI. Example: `https://yourcompany.openvpn.com`
3. **Server ID:** Unique identifier for this deployment to differentiate the Access Server from others using the same Subscription.
4. **Node URL:** Internal identifier used for API communication. Example: `abc123.access-server.cloud`
5. **VPN DNS Record:** Hostname used to connect to the VPN tunnel. Example: `def456.access-server.cloud`

## 🖥️ Connect to your new Access Server instance via SSH

> **Important**
>
> SSH isn't required for normal operation, as you have a fully functional Access Server using Access Server Link. SSH is useful for troubleshooting and for tasks that require console access.

1. Open a terminal or SSH client.
2. Connect using the appropriate SSH username for your cloud provider:

   | **Cloud provider** | **Default SSH username** |
   | --- | --- |
   | AWS | `ubuntu` |
   | Azure | `azureuser` (or the username you configured during deployment) |
   | GCP | Configured when adding SSH keys after VM creation. See [Google Cloud Documentation](https://docs.cloud.google.com/compute/docs/connect/add-ssh-keys#after-vm-creation). |
3. Run the following command:

   ```
   ssh -i /path/key-pair-name.pem ssh-username@instance-public-ipv4-address
   ```

   Replace `/path/key-pair-name.pem` with your private key, `<ssh-username>` with your SSH username, and `<instance-public-ipv4-address>` with your instance's public IP.

   > **Tip**
   >
   > See  [Connect to Access Server via SSH using PuTTY](https://openvpn.net/as-docs/v3/tutorials/tutorial--connect-with-putty.md) for steps to connect with the PuTTY SSH client from a Windows computer.

## 🛠️ Disabling and re-enabling Access Server Link

**To turn off Access Server Link from the Admin Web UI:**

1. Sign in to the Admin Web UI.
2. Go to **Web Services → Access Server Link**.
3. Toggle **Access Server Link** to **Off**.
4. Click **Save & Restart**.
5. Click **Turn Off Access Server Link**.

Once disabled, your Access Server Link URL and VPN DNS record will no longer route to your server. Your Admin and Client Web UI and VPN will be reachable via your instance's public IP instead.

> **Note**
>
> If you try to access the Admin Web UI from the Access Server Link URL when it's disabled, the following message displays:
>
> **Status: Offline**

> **Important**
>
> Disabling **Access Server Link** will affect existing VPN clients. Connection profiles (`.ovpn` files) that reference the VPN DNS record will stop working. Users will need to download new client profiles to reconnect.
>
> Additionally, if you use SAML authentication configured, update your IdP configuration with the new public IP or domain after disabling Access Server Link, and update the SAML settings in Access Server.

**To re-enable Access Server Link:**

1. Sign in to the Admin Web UI.
2. Go to **Web Services → Access Server Link**.
3. Toggle **Access Server Link** to **On**.
4. Click **Save & Restart**.
5. Click **Turn On Access Server Link**.
   - Changes may take a few minutes to take effect.

## 🌍 Using a custom domain and SSL certificate with Access Server Link

You can configure a custom domain name and SSL certificate for your web services alongside Access Server Link. Access Server Link uses a separate SNI-based certificate for API communication and can coexist with custom certificates.

- Configure a custom domain: **VPN Server → Network Settings → Server Address**.
- Configure a custom certificate: **Certificate Management → Web Server Certificate**.

You can also use the built-in [ACME client](https://openvpn.net/as-docs/v3/tutorials/tutorial--acme-web-ssl-certificates/#) to install certificates. Custom certificates and Access Server Link are fully compatible.

## ⚙️ Troubleshooting

### IP address changes

If your Access Server's public IP changes (for example, after a restart on an ephemeral IP), Access Server Link detects the change and updates DNS records automatically. The maximum expected downtime during an IP change is approximately 15-20 minutes.

### Admin or Client Web UI unreachable

If the Admin Web UI is reachable via its public IP, but not responding via Access Server Link URL:

- The system marks the server as **unreachable** after 10 minutes of failed connection attempts.
- Check that your Access Server is running and that your cloud provider's security group or firewall allows inbound traffic on TCP port 943 (or your configured Admin Web UI Port).
- Ensure the Admin and Client Web UI ports are set to the same value. A warning appears in the Admin Web UI if they differ.

### "Untrusted Node Detected" error in Access Server Hub

This warning appears when the proxy detects a certificate fingerprint that doesn't match the one registered for your deployment. Common causes:

- The deployment script was run a second time, generating a new key pair.
- The server was reinitialized (for example, using `ovpn-init`).
- The certificate was manually replaced.

When this error occurs, the Access Server Link URL won't route to your server, and the following message is displayed: **Status: Offline**.

To resolve:

1. Sign in to the Access Server Hub.
2. Click **My Access Servers** in the left panel.
3. Select your deployment and click **Manage**.
4. Click **View Server Details**.
5. Click the three-dot menu, then click **Verify and Make Active Node**.
6. Click **Send Verification Code**.
   - A 6-digit code is sent to your email address.
7. Enter the code in the prompt, then click **Verify**.
   - If successful, your Access Server will return to **Active** and **Online** status in the hub.

> **Important**
>
> This is only available if the certificate's common name matches your registered node identifier. You need to perform this action manually. An unexpected certificate will never be auto-trusted for security reasons.
>
> For security, verify that the certificate fingerprint (base64) shown in step 5 matches the certificate fingerprint (base64) from your Access Server.
>
> To verify this, you can follow the following steps in your Access Server:
>
> 1. Connect to the console and get root privileges.
> 2. Run the following command:
>
>    ```
>    sacli SubscriptionStatus | grep "'certfp'" | awk -F"'" '{print $6}'
>    ```
>
>    - Example output:
>
>      ```
>      yWc5w42MV6PrlY72oSpjIqfSjCZlEZrrrbGuihss3jA=
>      ```
>
> Verify that the output of this command matches the value under **SHA-256 Fingerprint (base64)** in the prompt shown in step 5.

### Admin UI port change

If you change the Admin Web UI port in your Access Server settings, the Admin Web UI will be temporarily unreachable via the Access Server Link URL for approximately 3-4 minutes while the change propagates. Access is restored automatically after this period.

> **Tip**
>
> When changing the Admin Web UI port, ensure your cloud provider's security group or firewall allows inbound HTTPS traffic on the newly configured port.

### OpenVPN Connect v2 compatibility

Access Server Link uses the [REST API only](https://openvpn.net/as-docs/rest-api.md) — XML-RPC isn't supported. As a result, OpenVPN Connect v2 import from server and server-locked v1 profiles aren't compatible with Access Server Link. Use [OpenVPN Connect v3](https://openvpn.net/vpn-client/) for all new deployments.

---

Prev: [Docker](https://openvpn.net/as-docs/v3/docker.md)
Next: [SHA256SUM Data](https://openvpn.net/as-docs/v3/sha256sum-data.md)
Index: https://openvpn.net/as-docs/llms.txt