Access Server 3.0 Release Notes and Version Updates⁠

Fixed security issue CVE-2025-13086.

Access Server versions 2.11.0 through 3.0.1 are affected — see the security advisory for details.

Added additional output to sacli support command to include IP information and CPU core count.

Added support for AWS regions Asia Pacific Taipei, Malaysia, Thailand, and Mexico for the AWS Tiered licensing model.

Added support for a passphrase for the private key to the check-private-key REST API endpoint.

Added back WEB_ADMIN to authentication handling and logging to differentiate admin-level logins.

Added token handling to sacli so API calls between cluster nodes don't require an admin-level account.

Added validation to stop admin users from blocking themselves by blocking the group they're in.

Added certificate issuer information to the API and the web server certificate page.

Added validation to ensure a certificate authority name is unique on the VPN server certificate page.

Added a new password field for locally authenticated users back to the user settings page.

Added a warning icon when enabling local MFA on a SAML user; MFA should be handled on the SAML IdP instead.

Added support for Red Hat 10 and Debian 13.

Released bundled clients package v35 with OpenVPN Connect v3.8.0.4528 for Windows and OpenVPN Connect v3.8.1.5790 for macOS.

Updated the DCO module to version 0.2.20251017.

Fixed Message-Authenticator digest not being verified when the RADIUS server is a hostname instead of an IP.

Fixed regression for prop_reroute_gw_override not applying to group permissions.

Fixed DCO enable setting in cluster mode to be a cluster-wide setting instead of per-node.

Fixed SAML authentication failure message for blocked accounts not being logged.

Fixed SAML authentication failure when the 'server override' option is used in Connect v3.

Fixed SAML authentication failure when the base64 SAML assertion contained a + symbol.

Fixed SAML invalid relaystate when it was left empty on IdP-initiated logins.

Fixed SAML service provider URL not allowing the specification of custom web service ports.

Fixed SAML settings not being cleared when a new metadata XML file was loaded.

Fixed the save button being always active even when there are no changes on the SAML configuration page.

Fixed internal server error on password change REST API endpoint when username was left empty.

Fixed returning too many items on configurationprofile list REST API endpoint when querying RADIUS settings.

Fixed Token URL not containing custom web service port.

Fixed searching for VPN client certificates by their serial number.

Fixed the count of users assigned to the default group in the groups overview.

Fixed showing the real IP address of the user authenticating via SAML in Activity Logs.

Fixed cluster nodes requiring a command-line level restart when the web certificates are replaced.

Fixed issue with Fixed License Key that expires today (and thus still valid) not showing in the overview.

Fixed the error message showing in the log file when the log DB for Activity Logs is disabled.

Fixed data-ciphers-fallback not being set in server config when vpn.server.enable_cipher_fallback is true.

Fixed sacli disconnectclient not working with --cn or --filter_by user/cn.

Fixed the EULA not displaying as expected when the CLIENTS_PKG_VERSION file is missing.

Fixed the confdba-ulf tool issue where it was unable to read the configuration dump back to the default configuration profile.

Fixed Proto(col) value not showing in Activity Logs.

Fixed handling of special characters in database credentials when converting SQLite to MySQL.

Fixed AWS Tiered licensing issue where only 2 out of 4 licensing servers were reachable.

Fixed issue with access control rules not showing when there are more than 1000 users, on Red Hat 8 OS.

Fixed post-auth script not receiving RADIUS reply data to enact user property adjustments.

Fixed group IPv4 subnet not being deleted when a group IPv6 subnet is present, on userprop REST API endpoint.

Fixed issue with site-to-site routing when the VPN client gateway has a static IP and DCO is used.

Fixed issue with re-enabling offering Connect v3 for macOS and Windows on the client web server.

Fixed the mismatch warning between the hostname setting and the web certificate on the web certificate page.

Fixed CA bundle upload being marked as ok even when no CA bundle was uploaded.

Fixed 'key and certificate' mismatch error not clearing on the web server certificate page.

Fixed the missing web certificate expiration message on the web server certificate page.

Fixed self-signed web certificates that were uploaded erroneously, not displaying as a user-provided certificate.

Fixed the static IP address pool setting, which was erroneously visible in cluster mode.

Fixed the interclient communication setting, which was erroneously visible in cluster mode.

Fixed an incorrect warning message about losing local user configurations when creating a cluster.

Fixed broken 'learn more here' link on the OpenVPN client certificate requirements setting.

Fixed the OpenVPN client certificate requirements setting, which was erroneously visible in External PKI mode.

Fixed Internet Access and DNS tab erroneously being visible in bridge mode.

Fixed broken search by user name functionality on the VPN client certificates page.

Fixed some missing indicators that certain settings are per-node settings in cluster mode.

Fixed the invalid date issue on the VPN client certificate page.

Fixed erroneously displayed option to download non-TLS Crypt v2 profile when only TLS Crypt v2 is allowed.

Fixed not being able to clear LDAP settings when LDAP authentication method is disabled.

Fixed custom HTTP header value not displaying correctly on the web interface when the value contains a colon.

Fixed port setting not saving when using only TCP or only UDP for VPN server settings.

Fixed incorrect source being displayed for values shown from the cluster configuration database.

Fixed erroneously not showing the default domain suffix setting when pushing the DNS server is disabled.

Fixed 'session expired' message popping upon opening the web interface with an expired token.

Fixed handling of user names that contain the percent (%) symbol on the web interface.

Fixed the inability to delete the last subnet for a group in group settings.

Fixed the Activity Logs page not showing any results when certain encoded characters are in the logs.

Improved various filtering and sorting in various areas of the web interface.

Improved error handling and validation in various areas of the Access Server.

Improved Diffie-Hellman settings by no longer defaulting to finite field parameters.

Improved detection of available CPU cores.

Improved error message shown when the wrong password is entered during password change on the client web server.

Improved message shown when deleting a group that contains users.

Improved displaying two-way interconnectivity rules as a single item instead of two separate items.

Improved behavior by disallowing the selection of an authentication system with errors for a new user or group.

Improved web session timeout behavior by refreshing the session token more frequently.

Improved activation flow on the web interface.

Improved MFA authentication page by automatically putting input focus on the MFA input field.

Removed now unused sa.session_expire configuration key support.