Handle pfSense OpenVPN exports as credentials, not ordinary configuration attachments

Inline and archive exports can contain the keys needed to authenticate a VPN client.

Source facts

Netgate’s OpenVPN Client Export package can produce several different client formats. Inline configurations include certificates and keys inside one file. An archive can contain the configuration, server TLS key when present, and a PKCS#12 file holding CA, client certificate, and client key material. By contrast, the File Only option exports configuration without certificates or keys for updating an existing setup. The package also offers password protection for selected key bundles, while server-CN verification controls which server identity the client expects.

Source: Netgate — OpenVPN Client Export.

Applicability

This concerns exports generated by the pfSense OpenVPN Client Export package. The appropriate format depends on the server authentication mode, target client, and the organization’s credential-delivery process.

DSE recommendation

DSE recommends classifying each exported file before sending it to a user. Deliver credential-bearing bundles through an approved protected channel with a verified recipient, and keep them out of general ticket attachments or shared folders. For a configuration-only update, confirm whether File Only is sufficient rather than issuing another full credential bundle. Record the user or certificate association, intended endpoint, and replacement procedure. Keep server-identity verification enabled through an appropriate supported configuration instead of relaxing it to solve an unrelated connection problem.

Verification

Inspect a disposable export to identify which sensitive components its selected format includes. Import it only on an approved test client and verify the intended server identity. Confirm that a configuration-only update does not unexpectedly distribute keys, then remove temporary credential-bearing files through the approved handling process.

Official reference

Netgate — OpenVPN Client Export. Reviewed October 15, 2026.