Configure OpenVPN client for P2S certificate authentication connections - Windows

Article
02/21/2024

If your point-to-site (P2S) VPN gateway is configured to use OpenVPN and certificate authentication, you can connect to your virtual network using the OpenVPN Client. This article walks you through the steps to configure the OpenVPN client and connect to your virtual network.

Before you begin

This article assumes that you've already performed the following prerequisites:

You created and configured your VPN gateway for point-to-site certificate authentication and the OpenVPN tunnel type. See Configure server settings for P2S VPN Gateway connections - certificate authentication for steps.
You generated client certificates and downloaded the VPN client configuration files. See Point-to-site VPN clients: certificate authentication - Windows

Before beginning client configuration steps, verify that you're on the correct VPN client configuration article. The following table shows the configuration articles available for VPN Gateway point-to-site VPN clients. Steps differ, depending on the authentication type, tunnel type, and the client OS.

Authentication	Tunnel type	Generate config files	Configure VPN client
Azure certificate	IKEv2, SSTP	Windows	Native VPN client
Azure certificate	OpenVPN	Windows	- OpenVPN client - Azure VPN client
Azure certificate	IKEv2, OpenVPN	macOS-iOS	macOS-iOS
Azure certificate	IKEv2, OpenVPN	Linux	Linux
Microsoft Entra ID	OpenVPN (SSL)	Windows	Windows
Microsoft Entra ID	OpenVPN (SSL)	macOS	macOS
RADIUS - certificate	-	Article	Article
RADIUS - password	-	Article	Article
RADIUS - other methods	-	Article	Article

Connection requirements

To connect to Azure, each connecting client computer requires the following items:

The Open VPN Client software must be installed and configured on each client computer.
The client computer must have a client certificate that's installed locally.

View configuration files

The VPN client profile configuration package contains specific folders. The files within the folders contain the settings needed to configure the VPN client profile on the client computer. The files and the settings they contain are specific to the VPN gateway and the type of authentication and tunnel your VPN gateway is configured to use.

Locate and unzip the VPN client profile configuration package you generated. For Certificate authentication and OpenVPN, you should see an OpenVPN folder. If you don't see the folder, verify the following items:

Verify that your VPN gateway is configured to use the OpenVPN tunnel type.
If you're using Microsoft Entra authentication, you might not have an OpenVPN folder. See the Microsoft Entra ID configuration article instead.

Configure the client

Note

OpenVPN Client version 2.6 is not yet supported.

Download and install the OpenVPN client (version 2.4 or higher) from the official OpenVPN website. Version 2.6 is not yet supported.
Locate the VPN client profile configuration package that you generated and downloaded to your computer. Extract the package. Go to the OpenVPN folder and open the vpnconfig.ovpn configuration file using Notepad.
Next, locate the child certificate you created. If you don't have the certificate, use one of the following links for steps to export the certificate. You'll use the certificate information in the next step.
- VPN Gateway instructions
- Virtual WAN instructions
From the child certificate, extract the private key and the base64 thumbprint from the .pfx. There are multiple ways to do this. Using OpenSSL on your computer is one way. The profileinfo.txt file contains the private key and the thumbprint for the CA and the Client certificate. Be sure to use the thumbprint of the client certificate.
```
openssl pkcs12 -in "filename.pfx" -nodes -out "profileinfo.txt"
```
Switch to the vpnconfig.ovpn file you opened in Notepad. Fill in the section between <cert> and </cert>, getting the values for $CLIENT_CERTIFICATE, $INTERMEDIATE_CERTIFICATE, and $ROOT_CERTIFICATE as shown below.
```
   # P2S client certificate
   # please fill this field with a PEM formatted cert
   <cert>
   $CLIENT_CERTIFICATE
   $INTERMEDIATE_CERTIFICATE (optional)
   $ROOT_CERTIFICATE
   </cert>
```
- Open profileinfo.txt from the previous step in Notepad. You can identify each certificate by looking at the subject= line. For example, if your child certificate is called P2SChildCert, your client certificate will be after the subject=CN = P2SChildCert attribute.
- For each certificate in the chain, copy the text (including and between) "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----".
- Only include an $INTERMEDIATE_CERTIFICATE value if you have an intermediate certificate in your profileinfo.txt file.
Open the profileinfo.txt in Notepad. To get the private key, select the text (including and between) "-----BEGIN PRIVATE KEY-----" and "-----END PRIVATE KEY-----" and copy it.
Go back to the vpnconfig.ovpn file in Notepad and find this section. Paste the private key replacing everything between and <key> and </key>.
```
# P2S client root certificate private key
# please fill this field with a PEM formatted key
<key>
$PRIVATEKEY
</key>
```
Don't change any other fields. Use the filled in configuration in client input to connect to the VPN.
Copy the vpnconfig.ovpn file to C:\Program Files\OpenVPN\config folder.
Right-click the OpenVPN icon in the system tray and click Connect.

Next steps

Point-to-site configuration steps Point-to-site VPN clients: certificate authentication - Windows