iOS Security FAQs
Wondering about OpenVPN Connect security and best practices? Refer to these FAQs.
Given that mobile devices are easily lost or stolen, we recommend these two steps to provide extra protection for your phone to secure VPN profiles against compromise of a lost device:
Save the private key in the device keychain—it’s the most sensitive data in a profile. Consider removing the client certificate and private key from the profile and saving them in the iOS Keychain instead.
Use a strong, device-level password. A strong password is critical for protecting data stored in the iOS Keychain.
Yes, it is safe to save your password if you have set up a strong device-level password. OpenVPN Connect stores authentication and private key passwords in the iOS Keychain, which the device-level password protects.
No, OpenVPN Connect uses the OpenSSL library, which is immune to Heartbleed.
The save password switch on the authentication password field is typically turned on, but you can turn it off by adding the following OpenVPN directive to the profile:
setenv ALLOW_PASSWORD_SAVE 0Yes, OpenVPN Connect supports the tls-crypt option in recent versions.