OVPN File Documentation

Summary

An OpenVPN Configuration File is a plain-text profile that tells an OpenVPN client how to reach a VPN server: its address, port, protocol, encryption, and often the certificates and keys embedded inline. Its extension is .ovpn and its MIME type is application/x-openvpn-profile. You do not read it to use it; you import it into a client such as OpenVPN Connect and connect. Treat the file as sensitive, because it can contain your private key.

Technical details

FeatureValue
Full nameOpenVPN Configuration File (client/server profile)
File extension.ovpn
MIME typeapplication/x-openvpn-profile
Format typePlain-text configuration (directives, one per line)
DeveloperOpenVPN Inc. (project founded by James Yonan)
IntroducedOpenVPN released 2001; .ovpn unified-profile convention popularised in the 2000s
Unix equivalentSame format as client.conf / server.conf
Character setPlain ASCII/UTF-8 text
SignatureNone — recognised by directives (client, remote, proto, dev)
Inline credential blocks<ca>, <cert>, <key>, <tls-auth>/<tls-crypt>
Embedded PEM-----BEGIN CERTIFICATE----- / -----BEGIN PRIVATE KEY-----
TransportUDP or TCP (proto directive)
SensitivityHigh — self-contained profiles embed a private key
Open standardYes — open-source protocol and reference client
Reference clientOpenVPN Connect (Windows, macOS, Linux, Android, iOS)
Related extensions.conf, .crt, .key, .pem, .p12
Specificationopenvpn.net/community-resources/reference-manual-for-openvpn/
Structure at a glance

An .ovpn file is plain text with no signature; it is one directive per line. A client profile opens with client, then remote <host> <port> (the server), proto udp or proto tcp (the transport), and dev tun (a routed IP tunnel) or dev tap (a bridged Ethernet tunnel). Crypto is set with cipher, auth and remote-cert-tls server. A self-contained profile then embeds its certificates inline between tags: <ca> (the CA that validates the server), <cert> and <key> (your client certificate and private key), and <tls-auth> or <tls-crypt> (an extra HMAC key). Anything inside <key> is a secret — handle the file like a password.

What is an OVPN file?

An .ovpn file is the configuration profile for OpenVPN, the open-source VPN protocol and software created by James Yonan and first released in 2001, now stewarded by OpenVPN Inc. It is plain text: a list of directives describing a single VPN connection — which server to reach, over which transport, with which encryption, and how to route traffic and DNS once connected. On Unix the same content is conventionally named client.conf or server.conf; the .ovpn extension is the unified client-profile form used on Windows and handed out by VPN providers.

You do not “open” an .ovpn the way you open a document. You import it into an OpenVPN client, which reads the directives and establishes the encrypted tunnel. The reference client is OpenVPN Connect (official, cross-platform); Tunnelblick is the popular free macOS client; on Linux the openvpn package or NetworkManager handles it; and on mobile there is OpenVPN Connect or the open-source OpenVPN for Android.

The directive syntax: remote, proto, dev and crypto

Each non-blank, non-comment line is a directive: a keyword followed by its arguments. Comments start with # or ;. A minimal client profile reads:

client
dev tun
proto udp
remote vpn.example.com 1194
resolv-retry infinite
nobind
remote-cert-tls server
cipher AES-256-GCM
auth SHA256
verb 3

client puts OpenVPN in client mode. dev tun selects a routed IP-layer tunnel (a tun device); dev tap would instead create a bridged Ethernet-layer tunnel. proto udp chooses the transport — UDP is the default and performs better, while proto tcp is used to punch through restrictive firewalls. remote vpn.example.com 1194 names the server host and port; multiple remote lines provide failover. remote-cert-tls server requires the peer to present a server certificate, blocking a client-for-server impersonation attack. cipher and auth set the data-channel encryption and HMAC. Because each line is independent, editing an .ovpn in a text editor to change the server or port is straightforward — just keep the .ovpn extension when you save.

Inline certificate blocks: ca, cert, key and tls-auth

Early OpenVPN profiles referenced separate certificate files on disk (ca ca.crt, cert client.crt, key client.key). Modern profiles are usually self-contained instead: the certificates are embedded directly in the .ovpn between XML-style tags, so one file is enough to connect from anywhere.

<ca>
-----BEGIN CERTIFICATE-----
MIID... (the certificate authority that validates the server)
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MIID... (your client certificate)
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIIE... (your PRIVATE key -- this is the secret)
-----END PRIVATE KEY-----
</key>
<tls-crypt>
-----BEGIN OpenVPN Static key V1-----
... (extra key that encrypts the TLS handshake)
-----END OpenVPN Static key V1-----
</tls-crypt>

The four blocks map to the four roles in OpenVPN’s mutual-TLS handshake. <ca> holds the certificate authority the client uses to verify the server. <cert> is the client’s own certificate, proving its identity to the server. <key> is the client’s private key, the one secret that must never be shared. <tls-auth> or the newer <tls-crypt> adds a shared static key that authenticates (tls-auth) or fully encrypts (tls-crypt) the control-channel packets, hardening the handshake against scanning and denial-of-service. The PEM text inside each block is base64-encoded DER, delimited by the familiar -----BEGIN ...----- / -----END ...----- lines. Combining separate ca.crt, client.crt, client.key and ta.key files into these blocks is the usual real-world “conversion” task, and it is just copy-and-paste in a text editor (or an export option in pfSense, OPNsense or PiVPN).

Importing a profile into a client

Using a profile is import-then-connect, and the exact step varies by client. In OpenVPN Connect you choose Import › File, pick the .ovpn, enter any username and password the server requires, and connect. The community OpenVPN GUI on Windows instead reads any .ovpn dropped into its config folder, connected from the tray icon. Tunnelblick on macOS installs a profile when you double-click the .ovpn. On Linux, sudo openvpn --config client.ovpn runs it directly, or NetworkManager’s OpenVPN plugin imports it from Settings. The same file works on Android and iOS through OpenVPN Connect.

Import failures almost always trace to one cause: a profile that references external files (ca.crt, client.key, or an auth-user-pass credentials file) that are not sitting next to it. Self-contained profiles with inline <ca>/<cert>/<key> blocks avoid the missing-file errors entirely, which is why providers ship them that way.

Security: the file is a credential, and untrusted profiles run code

An .ovpn carries two distinct risks, and both are serious. The first is that the file itself is sensitive. A self-contained profile embeds your client private key inside <key>, so anyone who obtains the file (plus any static password) may be able to connect to that VPN as you. Do not e-mail an .ovpn in the clear, do not commit it to a repository, store it with restrictive permissions, and if one leaks, have the server revoke and reissue the certificate.

The second risk runs the other way: a malicious profile can attack you. Two mechanics matter. An .ovpn can contain script directives — up, down, route-up, or plugin hooks — that execute commands on your machine at connect time; on some clients these run with elevated privileges. And even without scripts, the profile decides where all your traffic goes: directives like redirect-gateway def1 route your entire connection through the server named in the file, and dhcp-option DNS hands your DNS to it. An attacker’s profile therefore puts them in a man-in-the-middle position over everything you do online. The defence is simple: open any .ovpn in a text editor first, read which remote server it connects to and whether it contains script directives, and only import profiles from your real VPN provider or your own IT department.

.ovpn versus .conf, and why you cannot convert to WireGuard

An .ovpn and a Unix .conf are the same OpenVPN configuration format; converting between them is just renaming the file, since the directive syntax is identical. Converting to WireGuard is a different matter and is not possible: WireGuard is a separate protocol with different cryptography, different keys and different server software. Moving from OpenVPN to WireGuard means the server operator must support WireGuard and issue you a brand-new WireGuard config; no tool transforms an .ovpn into one. The embedded certificate and key can, if needed, be repackaged into a PKCS#12 (.p12) keystore with openssl pkcs12 -export, but that repackages the credentials, not the configuration.

Frequently asked questions

How do I open an OVPN file?

You import it into an OpenVPN client rather than opening it. Install OpenVPN Connect (all platforms) or Tunnelblick (macOS), choose Import › File, pick the .ovpn, enter any username and password, and connect. To inspect the settings, open the file in a text editor — but remember it may contain a private key.

Why does my .ovpn fail to import or connect?

Most often the profile references external files (ca.crt, client.key, or an auth-user-pass file) that are not next to it, or a username/password is missing, or the server is unreachable on the given port and protocol. Self-contained profiles with inline <ca>/<cert>/<key> blocks avoid the missing-file errors.

Is it safe to use an .ovpn someone sent me?

Only if you trust the source. The profile routes your traffic and DNS through the server it names and can include scripts that run on connect, so a malicious one can spy on or redirect everything you do. Open it in a text editor, check the remote line, and only import profiles from your real provider or IT.

References