Release notes for OpenVPN Connect on macOS⁠

SHA 256 checksum⁠

File Name	SHA256SUM
OpenVPN_Connect_3_9_1(6051)_arm64_Installer_signed.pkg	b10a33cb868d0ad5ff62460928a1c77f740d23450289c92c86358133b20baee7
OpenVPN_Connect_3_9_1(6051)_x86_64_Installer_signed.pkg	256389440844ad408ab8da380118ccee6fbf1dee744fd1bad842089c22891ea3

Launch the Terminal application on your Mac.
Navigate to the directory containing your downloaded installer. For example, if the file is in your Downloads folder, run:
```
cd ~/Downloads
```
Tip
You can also open Terminal directly from the folder containing your downloaded installer. In Finder, select View → Show Path Bar, Control-click the folder in the path bar, and select Open in Terminal. You can then skip the cd command.
Run the following command to calculate the SHA-256 checksum of your downloaded installer:
```
shasum -a 256 "<file-name>"
```
1. Replace <file-name> with the name of the installer you downloaded. For example, for a Mac with Apple silicon: "OpenVPN_Connect_1_2_3(4567)_arm64_Installer_signed.pkg"; for an Intel-based Mac: "OpenVPN_Connect_1_2_3(4567)_x86_64_Installer_signed.pkg".
Compare the checksum displayed in Terminal with the corresponding SHA256SUM listed on this page. If they match, the downloaded file has passed the integrity check.

3.9.1 (6051)⁠

Fixed certain routing issues.

Improvements⁠

Updated the macOS connectivity architecture to use Apple's native Network Extension framework for improved stability, modern security enforcement, and reliable connection handling.
Note
After upgrading to OpenVPN Connect 3.9.0, you need to approve the OpenVPN Network Extension when prompted by macOS. This approval is required to establish VPN connections.
Upgraded OpenVPN Core to version 3.11.8 and OpenSSL to version 3.5.8, incorporating packet processing enhancements, connection stability fixes, and upstream security updates.

Fixes⁠

Fixed a security vulnerability that could allow the remote-cert-tls server directive to be bypassed. OpenVPN Connect now correctly enforces Extended Key Usage (EKU) validation when verifying server certificates.
Fixed an issue where switching between internet access points while seamless tunnel was enabled could cause OpenVPN Connect to repeatedly attempt to reconnect.

Fixed a security vulnerability in the macOS privileged helper component (CVE-2026-9560), reported by Ismael Esquilichi, Pablo Redondo, and Lê Đức Ninh.
Fixed an issue where entering a server URL ending with /, ?, or # would prevent the app from launching the browser for web-based authentication.
Fixed an issue where the manual profile import screen displayed instead, which could result in a blank profile being imported or the app crashing when switching profiles.

The application's user interface has been reworked to provide a modern design and more intuitive user experience.
Dropped support of macOS Catalina and added support of macOS Tahoe.
Confirmation Dialogs setting renamed to Show Confirmation Dialog on Disconnect.
Minimize on launch setting is added. It allows users to control the app window behavior.
Launch Options replaced with two new settings, providing more flexibility in configuraiton: Launch at Startup and Connect on Launch.
Added possibility to Import or pre-save server URL/CloudID via Global Config or manually after first successful profile import. Refer to Global Configuration File Support for macOS.
Fixed the issue with absence of confirmation message on successful import operation for Global Config using CLI.
Fixed an issue when Client side script dialog persists on connection after it's no-longer being pushed by server.
"Don't show again" checkbox from the "Missing external certificate" modal moved to profile edit screen as Require External Certificate [on/off].
Other minor improvements and fixes.

Added support of "Global Config" feature that allows configuring the app settings, importing profiles, and creating proxies by applying the single file. Refer to Global Configuration File Support for macOS.
DNS protocol stability improved.
Fixed an issue when username, passwords, and certs, aren't correctly saved if they're saved on the Imported Profile screen.
Resolved a problem when "ovpnagent: request error" appears when parsing ipv4/ipv6 address.
Small fixes and improvements.

Dropped support of 10.13 High Sierra and 10.14 Mojave MacOS versions.
Implemented Device Posture Checks feature. (Businesses can now ensure that only devices that meet certain security standards access the network. This can help protect the network from unauthorized access and malware infections.)
Forced re-authentication support was added (interrupts VPN connection after x number of hours and forces user to re-authenticate).
Enhanced DNS stability and productivity.
Connection through proxy with basic auth is now allowed only with an “Insecure” security level.
Introduced support for external EC (elliptic serves signature algorithms) certificates.
Certificate validation added on Connection(not allowed to connect with expired certificates).
The “Import Profiles” screen has been updated.
Fixed an issue when the ARM version of the application didn't start.
Fixed the problem with routing to the 128.0.0.0/1 subnet.
The "Allow IPv6" setting is now changed to "Block IPv6" to better understand the setting's behavior.
The app now supports the CMD + W combination to close.
Other minor fixes and improvements.

Added support for environment variables for Access Server.
Added "Security Level" setting.
Updated OpenVPN 3 library to version 3.8.1.
Updated OpenSSL library to version 3.0.8.
Removed onboarding screens.
Fixed a bug when importing profile from a server with Let’s Encrypt certificate.
Fixed the issue with numeric pad enter button not working.
Fixed the issue with log screen scrolling in opposite direction.
Various bug fixes and user experience improvements.

Dropped support of OSX Yosemite.
Fixed security issue CVE-2022-3761 with checking web certificates during import process. Thanks to Mr. Ka Lok Wu of the Chinese University of Hong Kong for reporting this.
Fixed a bug when importing profile from a server with Let’s Encrypt certificate.
Added support for Apple Silicon chipset.
Added setting hide or show the icon in the Dock.
Added confirmation dialog during connection with external web authentication.
Fixed reporting of OpenVPN3 version as IV_VER variable.
Fixed issue with multiple notifications on macOS Ventura.

Dropped support of OSX Mavericks.
Added command line interface. Refer to Manage OpenVPN Connect from the Command Line (Windows) or Manage OpenVPN Connect from the Command Line (macOS).
Added support for PKCS11 hardware tokens. Refer to Connect and Authorize Hardware Tokens.
Updated OpenVPN 3 library to 3.6.3 version.
Added captive portal detection.
Added new functionality for software updates.
Replaced reconnect on reboot setting with launch options.
Added an Advanced Settings section.
Added colorful tray icons to show connection status.
Removed the “force AES-CBC cipher” legacy compatibility option.
Various bug fixes and UX improvements.

As part of the transition from Mbed TLS to OpenSSL the list of negotiable TLS cipher suites no longer includes weak cipher suites that lack forward secrecy support (DH/ECDH).
Switchover from Mbed TLS library to OpenSSL library.
Support of TLS 1.3 version.
Support signing with RSA-PSS signatures during TLS handshake.
Update of OpenVPN3 library to OpenVPN core 3.5.6 version.
Improved stability and performance.

New profile import flow with WebAuth support.
Added EULA license during installation.
Added .ovpn file association.
Added possibility to connect without external certificate when the client certificate is not required.
Fixed app crash when UI stucks with blank screen.
Fixed multiple re-connections in sleep mode.
Fixed connection with DUO authentication service.
Fixed connection via server-locked profile with 2FA.
Fixed issue with DNS configurations after disconnect.
Fixed proxy basic authentication.
Fixed issue with long client-side scripts.

Fixed a problem where the program would not respond properly during network unavailability.
Fixed profile import with server certificate expired or self-signed — added ability to accept or reject such certificate despite this problem.
Fixed password clearing during profile edit.
Fixed parsing of ca.crt as a separate file.
Fixed auth fail when username is not locked.
Showing proper core version in the connection logs.
Added descriptive error message for connection attempt via TAP-based profiles.

Fixed behavior of connection timeout with network unavailable.
Fixed connection logic via server-locked profile for users without auto-login privilege.
Fixed profiles sorting in tray by last connected.
Fixed static-challenge response logic.
Added confirmation on dialogs by enter key.
Added custom error message for users who trying to import auto-login profile without privilege.
Changed tray icon in order to show VPN connection status.
Changed order of settings in tray to be more logical.
Updated installer texts so the product name is mentioned properly.

This version drops support for macOS 10.8 Mountain Lion.
Dropped support of MD5 algorithm.
New unified UI with 2 color scheme options.
Disabled tunnel compression by default (could be enabled back in the app settings).
Ability to add proxies for connection from within the app.
Ability to manage external certificates directly from within the app.
Separate screen with extended statistics of connection session.
Log File with options to pause/resume, clear and save logs for sharing.
Plenty of other settings like reconnect on reboot, seamless tunnel, IP/TLS versions etc.

mbedTLS: fix incompatibility with PKI created by OpenSSL 1.1.
mbedTLS: add support for ECDSA.
mbedTLS: updated to fix CVE-2018-0487 vulnerability.
Issue OpenVPN client showing 'no VPN servers' when a connection profile with an excessively long server host name was loaded is now fixed.
TLS key refresh (TLS soft reset) connection interruption when using --opt-verify is now fixed.

Release notes for OpenVPN Connect on macOS⁠

SHA 256 checksum⁠

3.9.1 (6051)⁠

Was this information helpful?