{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/pfsense-openvpn-client-export-credential-package-handling/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/pfsense-openvpn-client-export-credential-package-handling/",
        "slug": "pfsense-openvpn-client-export-credential-package-handling",
        "url": "https://update.dsesecurity.com/updates/pfsense-openvpn-client-export-credential-package-handling/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/pfsense-openvpn-client-export-credential-package-handling.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/pfsense-openvpn-client-export-credential-package-handling/"
        },
        "title": "Handle pfSense OpenVPN exports as credentials, not ordinary configuration attachments",
        "summary": "Inline and archive exports can contain the keys needed to authenticate a VPN client.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "physical-security",
            "label": "Physical security",
            "alt": "Integrated video surveillance and controlled entry at a modern commercial facility.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/physical-security-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/physical-security-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T13:33:38+00:00",
        "modified_at": "2026-10-15T13:36:17+00:00",
        "reviewed_on": "2026-10-15",
        "reading_minutes": 2,
        "word_count": 271,
        "potentially_affected": "This concerns exports generated by the pfSense OpenVPN Client Export package. The appropriate format depends on the server authentication mode, target client, and the organization’s credential-delivery process.",
        "dse_recommendation": "DSE recommends classifying each exported file before sending it to a user.",
        "primary_source": {
            "name": "Netgate — OpenVPN Client Export",
            "url": "https://docs.netgate.com/pfsense/en/latest/packages/openvpn-client-export.html",
            "published_on": null,
            "authority": "docs.netgate.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Inline and archive exports can contain the keys needed to authenticate a VPN client.</p>\n<h2>Source facts</h2>\n<p>Netgate’s OpenVPN Client Export package can produce several different client formats. Inline configurations include certificates and keys inside one file. An archive can contain the configuration, server TLS key when present, and a PKCS#12 file holding CA, client certificate, and client key material. By contrast, the File Only option exports configuration without certificates or keys for updating an existing setup. The package also offers password protection for selected key bundles, while server-CN verification controls which server identity the client expects.</p>\n<p>Source: <a href=\"https://docs.netgate.com/pfsense/en/latest/packages/openvpn-client-export.html\">Netgate — OpenVPN Client Export</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns exports generated by the pfSense OpenVPN Client Export package. The appropriate format depends on the server authentication mode, target client, and the organization’s credential-delivery process.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends classifying each exported file before sending it to a user. Deliver credential-bearing bundles through an approved protected channel with a verified recipient, and keep them out of general ticket attachments or shared folders. For a configuration-only update, confirm whether File Only is sufficient rather than issuing another full credential bundle. Record the user or certificate association, intended endpoint, and replacement procedure. Keep server-identity verification enabled through an appropriate supported configuration instead of relaxing it to solve an unrelated connection problem.</p>\n<h2>Verification</h2>\n<p>Inspect a disposable export to identify which sensitive components its selected format includes. Import it only on an approved test client and verify the intended server identity. Confirm that a configuration-only update does not unexpectedly distribute keys, then remove temporary credential-bearing files through the approved handling process.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.netgate.com/pfsense/en/latest/packages/openvpn-client-export.html\">Netgate — OpenVPN Client Export</a>. Reviewed October 15, 2026.</p>",
        "content_text": "Inline and archive exports can contain the keys needed to authenticate a VPN client.\nSource facts\nNetgate’s OpenVPN Client Export package can produce several different client formats. Inline configurations include certificates and keys inside one file. An archive can contain the configuration, server TLS key when present, and a PKCS#12 file holding CA, client certificate, and client key material. By contrast, the File Only option exports configuration without certificates or keys for updating an existing setup. The package also offers password protection for selected key bundles, while server-CN verification controls which server identity the client expects.\nSource: Netgate — OpenVPN Client Export.\nApplicability\nThis concerns exports generated by the pfSense OpenVPN Client Export package. The appropriate format depends on the server authentication mode, target client, and the organization’s credential-delivery process.\nDSE recommendation\nDSE recommends classifying each exported file before sending it to a user. Deliver credential-bearing bundles through an approved protected channel with a verified recipient, and keep them out of general ticket attachments or shared folders. For a configuration-only update, confirm whether File Only is sufficient rather than issuing another full credential bundle. Record the user or certificate association, intended endpoint, and replacement procedure. Keep server-identity verification enabled through an appropriate supported configuration instead of relaxing it to solve an unrelated connection problem.\nVerification\nInspect a disposable export to identify which sensitive components its selected format includes. Import it only on an approved test client and verify the intended server identity. Confirm that a configuration-only update does not unexpectedly distribute keys, then remove temporary credential-bearing files through the approved handling process.\nOfficial reference\nNetgate — OpenVPN Client Export. Reviewed October 15, 2026.",
        "content_markdown": "Inline and archive exports can contain the keys needed to authenticate a VPN client.\n\n## Source facts\n\nNetgate’s OpenVPN Client Export package can produce several different client formats. Inline configurations include certificates and keys inside one file. An archive can contain the configuration, server TLS key when present, and a PKCS#12 file holding CA, client certificate, and client key material. By contrast, the File Only option exports configuration without certificates or keys for updating an existing setup. The package also offers password protection for selected key bundles, while server-CN verification controls which server identity the client expects.\n\nSource: [Netgate — OpenVPN Client Export](https://docs.netgate.com/pfsense/en/latest/packages/openvpn-client-export.html).\n\n## Applicability\n\nThis concerns exports generated by the pfSense OpenVPN Client Export package. The appropriate format depends on the server authentication mode, target client, and the organization’s credential-delivery process.\n\n## DSE recommendation\n\nDSE recommends classifying each exported file before sending it to a user. Deliver credential-bearing bundles through an approved protected channel with a verified recipient, and keep them out of general ticket attachments or shared folders. For a configuration-only update, confirm whether File Only is sufficient rather than issuing another full credential bundle. Record the user or certificate association, intended endpoint, and replacement procedure. Keep server-identity verification enabled through an appropriate supported configuration instead of relaxing it to solve an unrelated connection problem.\n\n## Verification\n\nInspect a disposable export to identify which sensitive components its selected format includes. Import it only on an approved test client and verify the intended server identity. Confirm that a configuration-only update does not unexpectedly distribute keys, then remove temporary credential-bearing files through the approved handling process.\n\n## Official reference\n\n[Netgate — OpenVPN Client Export](https://docs.netgate.com/pfsense/en/latest/packages/openvpn-client-export.html). Reviewed October 15, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/pfsense-openvpn-client-export-credential-package-handling/",
                "url": "https://update.dsesecurity.com/updates/pfsense-openvpn-client-export-credential-package-handling/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-15"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/pfsense-openvpn-client-export-credential-package-handling/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Handle pfSense OpenVPN exports as credentials, not ordinary configuration attachments",
                        "item": "https://update.dsesecurity.com/updates/pfsense-openvpn-client-export-credential-package-handling/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/pfsense-openvpn-client-export-credential-package-handling/#article",
                "identifier": "https://update.dsesecurity.com/updates/pfsense-openvpn-client-export-credential-package-handling/",
                "url": "https://update.dsesecurity.com/updates/pfsense-openvpn-client-export-credential-package-handling/",
                "headline": "Handle pfSense OpenVPN exports as credentials, not ordinary configuration attachments",
                "description": "Inline and archive exports can contain the keys needed to authenticate a VPN client.",
                "abstract": "Inline and archive exports can contain the keys needed to authenticate a VPN client.",
                "articleBody": "Inline and archive exports can contain the keys needed to authenticate a VPN client.\nSource facts\nNetgate’s OpenVPN Client Export package can produce several different client formats. Inline configurations include certificates and keys inside one file. An archive can contain the configuration, server TLS key when present, and a PKCS#12 file holding CA, client certificate, and client key material. By contrast, the File Only option exports configuration without certificates or keys for updating an existing setup. The package also offers password protection for selected key bundles, while server-CN verification controls which server identity the client expects.\nSource: Netgate — OpenVPN Client Export.\nApplicability\nThis concerns exports generated by the pfSense OpenVPN Client Export package. The appropriate format depends on the server authentication mode, target client, and the organization’s credential-delivery process.\nDSE recommendation\nDSE recommends classifying each exported file before sending it to a user. Deliver credential-bearing bundles through an approved protected channel with a verified recipient, and keep them out of general ticket attachments or shared folders. For a configuration-only update, confirm whether File Only is sufficient rather than issuing another full credential bundle. Record the user or certificate association, intended endpoint, and replacement procedure. Keep server-identity verification enabled through an appropriate supported configuration instead of relaxing it to solve an unrelated connection problem.\nVerification\nInspect a disposable export to identify which sensitive components its selected format includes. Import it only on an approved test client and verify the intended server identity. Confirm that a configuration-only update does not unexpectedly distribute keys, then remove temporary credential-bearing files through the approved handling process.\nOfficial reference\nNetgate — OpenVPN Client Export. Reviewed October 15, 2026.",
                "datePublished": "2026-10-15T13:33:38+00:00",
                "dateModified": "2026-10-15T13:36:17+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/pfsense-openvpn-client-export-credential-package-handling/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/pfsense-openvpn-client-export-credential-package-handling/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Handle pfSense OpenVPN exports as credentials, not ordinary configuration attachments"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 271,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Netgate — OpenVPN Client Export",
                    "url": "https://docs.netgate.com/pfsense/en/latest/packages/openvpn-client-export.html"
                }
            }
        ]
    }
}