# Handle pfSense OpenVPN exports as credentials, not ordinary configuration attachments

> Inline and archive exports can contain the keys needed to authenticate a VPN client.

- Canonical URL: https://update.dsesecurity.com/updates/pfsense-openvpn-client-export-credential-package-handling/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:33:38+00:00
- Modified: 2026-10-15T13:36:17+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Inline and archive exports can contain the keys needed to authenticate a VPN client.

## Potentially affected

This concerns exports generated by the pfSense OpenVPN Client Export package. The appropriate format depends on the server authentication mode, target client, and the organization’s credential-delivery process.

## DSE recommendation

DSE recommends classifying each exported file before sending it to a user.

## Article

Inline and archive exports can contain the keys needed to authenticate a VPN client.

## Source facts

Netgate’s OpenVPN Client Export package can produce several different client formats. Inline configurations include certificates and keys inside one file. An archive can contain the configuration, server TLS key when present, and a PKCS#12 file holding CA, client certificate, and client key material. By contrast, the File Only option exports configuration without certificates or keys for updating an existing setup. The package also offers password protection for selected key bundles, while server-CN verification controls which server identity the client expects.

Source: [Netgate — OpenVPN Client Export](https://docs.netgate.com/pfsense/en/latest/packages/openvpn-client-export.html).

## Applicability

This concerns exports generated by the pfSense OpenVPN Client Export package. The appropriate format depends on the server authentication mode, target client, and the organization’s credential-delivery process.

## DSE recommendation

DSE recommends classifying each exported file before sending it to a user. Deliver credential-bearing bundles through an approved protected channel with a verified recipient, and keep them out of general ticket attachments or shared folders. For a configuration-only update, confirm whether File Only is sufficient rather than issuing another full credential bundle. Record the user or certificate association, intended endpoint, and replacement procedure. Keep server-identity verification enabled through an appropriate supported configuration instead of relaxing it to solve an unrelated connection problem.

## Verification

Inspect a disposable export to identify which sensitive components its selected format includes. Import it only on an approved test client and verify the intended server identity. Confirm that a configuration-only update does not unexpectedly distribute keys, then remove temporary credential-bearing files through the approved handling process.

## Official reference

[Netgate — OpenVPN Client Export](https://docs.netgate.com/pfsense/en/latest/packages/openvpn-client-export.html). Reviewed October 15, 2026.

## Primary reference

- Name: Netgate — OpenVPN Client Export
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/packages/openvpn-client-export.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Handle pfSense OpenVPN exports as credentials, not ordinary configuration attachments,” DSE Security, https://update.dsesecurity.com/updates/pfsense-openvpn-client-export-credential-package-handling/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.