Managing Access Server's VPN Web Services⁠

Follow this tutorial to install a signed certificate, private key, and intermediary file from the CLI:

• Install a Signed SSL Certificate from the Command-line Interface

Access Server supports the following branding options:

1. Displaying your business logo on the Admin and Client Web UI login screens.

2. Adding a description text string to display on the Admin Web UI.

3. Removing the “powered by OpenVPN” footer.

Follow this tutorial to make these changes:

• How to Change the Branding on the Admin and Client Web UIs

You can change the "Server" HTTP header that the Access Server's built-in web server uses to identify itself to clients (browsers).

• How to Set a Custom Web Server Name

The web server built into Access Server 2.9.4 and newer can be provided with additional HTTP headers. This is useful when security scanners test the web interface and require certain headers to be present. You can set multiple headers by specifying multiple configuration keys.

• Specify Custom HTTP Headers

When you authenticate to Access Server's Client Web UI (or client web service, CWS) or Admin Web UI (or admin web services, AWS), your session remains active for a set timeframe. You remain signed in while you're actively using the web page, but your session expires if you're inactive for 30 minutes.

• How to Change the Web Session Timeout

HTTPS-protected web services must define which encryption ciphers they support. This is a balance of security versus compatibility. The strongest security makes the web interface inaccessible on older platforms. We try to choose a default Access Server setting that supports current operating systems and browsers. You can adjust the cipher suite string for your needs.

• Harden the Web Server Cipher Suite String

You can adjust the TLS settings for the Access Server web server from the Admin Web UI or command-line interface (CLI).

• Select the SSL and TLS Levels on the Web Server

When installing Access Server, the web services and OpenVPN daemons listen on all interfaces by default. You can change this in the Admin Web UI or the command-line interface (CLI), which are covered here.

• Set the Interface and Ports for the Web Services

The OpenVPN TCP daemon and the web services are connected. This is done with service forwarding, which internally redirects web browser requests made to the OpenVPN TCP daemon, running on the default HTTPS port TCP 443, to where the web services are actually running.

• Change the Web Service Forwarding Settings