Modifier

Partager via

Configure P2S VPN clients: certificate authentication - OpenVPN client - macOS

  • Article

This article helps you connect to your Azure virtual network (VNet) using VPN Gateway point-to-site (P2S) and Certificate authentication on macOS using an OpenVPN client.

Before you begin

Before you begin configuring your client, verify that you're on the correct article. The following table shows the configuration articles available for Azure VPN Gateway P2S VPN clients. Steps differ, depending on the authentication type, tunnel type, and the client OS.

Authentication Tunnel type Client OS VPN client
Certificate
IKEv2, SSTP Windows Native VPN client
IKEv2 macOS Native VPN client
IKEv2 Linux strongSwan
OpenVPN Windows Azure VPN client
OpenVPN client
OpenVPN macOS OpenVPN client
OpenVPN iOS OpenVPN client
OpenVPN Linux Azure VPN Client
OpenVPN client
Microsoft Entra ID
OpenVPN Windows Azure VPN client
OpenVPN macOS Azure VPN Client
OpenVPN Linux Azure VPN Client

Prerequisites

This article assumes that you've already performed the following prerequisites:

Connection requirements

To connect to Azure using the OpenVPN client using certificate authentication, each connecting client requires the following items:

  • The Open VPN Client software must be installed and configured on each client.
  • The client must have a client certificate that's installed locally.

Workflow

The workflow for this article is:

  1. Install the OpenVPN client.
  2. View the VPN client profile configuration files contained in the VPN client profile configuration package that you generated.
  3. Configure the OpenVPN client.
  4. Connect to Azure.

Generate client certificates

For certificate authentication, a client certificate must be installed on each client computer. The client certificate you want to use must be exported with the private key, and must contain all certificates in the certification path.

For information about working with certificates, see Point-to site: Generate certificates - Linux.

Configure the OpenVPN client

The following example uses TunnelBlick.

Important

Only MacOS 10.13 and above is supported with OpenVPN protocol.

Note

OpenVPN Client version 2.6 is not yet supported.

  1. Download and install an OpenVPN client, such as TunnelBlick.

  2. If you haven't already done so, download the VPN client profile package from the Azure portal.

  3. Unzip the profile. Open the vpnconfig.ovpn configuration file from the OpenVPN folder in a text editor.

  4. Fill in the P2S client certificate section with the P2S client certificate public key in base64. In a PEM formatted certificate, you can open the .cer file and copy over the base64 key between the certificate headers.

  5. Fill in the private key section with the P2S client certificate private key in base64. See Export your private key on the OpenVPN site for information about how to extract a private key.

  6. Don't change any other fields. Use the filled in configuration in client input to connect to the VPN.

  7. Double-click the profile file to create the profile in Tunnelblick.

  8. Launch Tunnelblick from the applications folder.

  9. Click on the Tunnelblick icon in the system tray and pick connect.

Next steps

Follow up with any additional server or connection settings. See Point-to-site configuration steps.