Connect and Authorize Hardware Tokens
OpenVPN Connect supports external certificates on PKCS#11 hardware tokens for VPN connections. This page provides an overview of setting it up on your device. The instructions are applicable for Yubikey hardware tokens with PKCS#11 support, such as Yubikey 5 NFC. You can try the same steps with modules for hardware tokens of other vendors.
For a detailed tutorial on setting up Yubikey hardware tokens for Access Server, refer to this support article: Access Server: PKCS#11 hardware tokens for VPN connections.
Before you begin
Make sure you've already done the following:
Installed the hardware token management software. (Refer to the Yubikey site: Releases.)
Imported the private key and certificate pair on the hardware token. (Refer to the Yubikey site: key import.)
Find your operating system below and follow the steps.
macOS
Locate the library:
/usr/local/lib/libykcs11.x.x.x.dylibE.g., libykcs11.2.3.0.dylib — ensure it's a file, not a symlink.
Open Terminal and execute this command to create a symlink to the library file:
ln -s /usr/local/lib/libykcs11.x.x.x.dylib ~/.pkcs11_modules/libykcs11.dylibWhere x.x.x is the version of the file from step one.
Windows
Add
<Program Files>\Yubico\Yubico PIV Tool\binto $PATH environment variable (System).Copy
<Program Files>\Yubico\Yubico PIV Tool\bin\libykcs11.dllto<Program Files>\OpenVPN Connect\pkcs11_modules.
For both macOS and Windows, exit out of OpenVPN Connect and then follow these steps:
Launch OpenVPN Connect.
Click or tap the Edit icon for the desired profile.
Under Certificate and Key, click or tap Assign.
Click or tap Hardware Tokens and select the hardware token from the list.
Click or tap Authorize and enter a PIN for the desired hardware token.
After successful authorization, choose the certificate and key for connection with the profile.
Click or tap Confirm.
Save the profile configuration.
Now that you have a proper certificate and key assigned to the profile, you can plug in your hardware token and connect using your profile:
Click or tap the profile toggle to connect.
After a successful connection, OpenVPN Connect displays connection statistics.