Tutorial: Use YubiKey as TOTP MFA token⁠

Overview⁠

This tutorial shows how to use a YubiKey as a time-based one-time password (TOTP) authenticator when connecting with OpenVPN Connect.

You’ll enroll your YubiKey with your VPN account and use it to generate one-time codes during login.

Prerequisites⁠

• An Access Server with TOTP MFA enabled.

• An OpenVPN Connect profile configured for your user.

• A YubiKey (or compatible hardware token with TOTP support).

• Yubico Authenticator installed on your device.

Step 1: Enroll your YubiKey⁠

1. Open a web browser and sign in to the Client Web UI.

2. When prompted, note the QR code and enrollment code.

3. Open the Yubico Authenticator.

4. Insert or connect your YubiKey.

5. Click Add account.

6. Scan the QR code or enter the enrollment code manually.

7. Confirm the account details, then click Save.

8. Enter the six-digit code shown in the authenticator.

9. Click Confirm Code.

   • Your YubiKey is enrolled now as a TOTP authenticator.

   • The user account now requires a one-time password during login.

Step 2: Connect using OpenVPN Connect⁠

1. Open OpenVPN Connect.

2. Start your VPN connection.

3. Enter your username and password.

4. When prompted for MFA:

   • Open Yubico Authenticator.

   • Insert or tap your YubiKey (if required).

   • Enter the six-digit code.

5. The VPN connection starts after successful authentication.

Tips⁠

• TOTP codes refresh every 30 seconds.

• Always use the latest code displayed.

• Keep your YubiKey accessible when connecting.

Troubleshooting⁠