I want to download client.openvpn profiles, so that I can connect my VPN with a third party client.
When connecting with username/password via Tunnelblick or nmcli, I get an authentication failure. See the following log output from Tunnelblick:
2015-12-01 13:21:39 *Tunnelblick: openvpnstart starting OpenVPN
2015-12-01 13:21:39 *Tunnelblick: OS X 10.10.3; Tunnelblick 3.5.4 (build 4270.4395); prior version 3.5.3 (build 4270.4371)
2015-12-01 13:21:39 *Tunnelblick: Attempting connection with client using shadow copy; Set nameserver = 1; monitoring connection
2015-12-01 13:21:39 *Tunnelblick: openvpnstart start client.tblk 1339 1 0 1 0 16689 -ptADGNWradsgnw 2.3.6
2015-12-01 13:21:41 *Tunnelblick: openvpnstart log:
Loading tun-signed.kext
OpenVPN started successfully. Command used to start OpenVPN (one argument per displayed line):
/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.3.6/openvpn
--daemon
--log
/Library/Application Support/Tunnelblick/Logs/-SUsers-SXXX-SLibrary-SApplication Support-STunnelblick-SConfigurations-Sclient.tblk-SContents-SResources-Sconfig.ovpn.1_0_1_0_16689.1339.openvpn.log
--cd
/Library/Application Support/Tunnelblick/Users/XXX/client.tblk/Contents/Resources
--config
/Library/Application Support/Tunnelblick/Users/XXX/client.tblk/Contents/Resources/config.ovpn
--cd
/Library/Application Support/Tunnelblick/Users/XXX/client.tblk/Contents/Resources
--management
127.0.0.1
1339
--management-query-passwords
--management-hold
--script-security
2
--up
/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -d -f -m -w -ptADGNWradsgnw
--down
/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -d -f -m -w -ptADGNWradsgnw
2015-12-01 13:21:40 OpenVPN 2.3.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Sep 19 2015
2015-12-01 13:21:40 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08
2015-12-01 13:21:40 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1339
2015-12-01 13:21:40 Need hold release from management interface, waiting...
2015-12-01 13:21:41 *Tunnelblick: Established communication with OpenVPN
2015-12-01 13:21:41 *Tunnelblick: Obtained VPN username and password from the Keychain
2015-12-01 13:21:41 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1339
2015-12-01 13:21:41 MANAGEMENT: CMD 'pid'
2015-12-01 13:21:41 MANAGEMENT: CMD 'state on'
2015-12-01 13:21:41 MANAGEMENT: CMD 'state'
2015-12-01 13:21:41 MANAGEMENT: CMD 'bytecount 1'
2015-12-01 13:21:41 MANAGEMENT: CMD 'hold release'
2015-12-01 13:21:41 MANAGEMENT: CMD 'username "Auth" "XXX@XXX.com"'
2015-12-01 13:21:41 MANAGEMENT: CMD 'password [...]'
2015-12-01 13:21:41 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2015-12-01 13:21:41 Control Channel Authentication: tls-auth using INLINE static key file
2015-12-01 13:21:41 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2015-12-01 13:21:41 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2015-12-01 13:21:41 Socket Buffers: R=[196724->100000] S=[9216->100000]
2015-12-01 13:21:41 UDPv4 link local: [undef]
2015-12-01 13:21:41 UDPv4 link remote: [AF_INET]XX.XX.XX.XX:1194
2015-12-01 13:21:41 MANAGEMENT: >STATE:1449004901,WAIT,,,
2015-12-01 13:21:41 MANAGEMENT: >STATE:1449004901,AUTH,,,
2015-12-01 13:21:41 TLS: Initial packet from [AF_INET]XX.XX.XX.XX:1194, sid=f2e0f8b9 ad4a11c3
2015-12-01 13:21:41 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2015-12-01 13:21:42 VERIFY OK: depth=1, CN=OpenVPN CA
2015-12-01 13:21:42 VERIFY OK: nsCertType=SERVER
2015-12-01 13:21:42 VERIFY OK: depth=0, CN=OpenVPN Server
2015-12-01 13:21:43 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2015-12-01 13:21:43 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2015-12-01 13:21:43 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2015-12-01 13:21:43 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2015-12-01 13:21:43 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
2015-12-01 13:21:43 [OpenVPN Server] Peer Connection Initiated with [AF_INET]XX.XX.XX.XX:1194
2015-12-01 13:21:44 MANAGEMENT: >STATE:1449004904,GET_CONFIG,,,
2015-12-01 13:21:46 SENT CONTROL [OpenVPN Server]: 'PUSH_REQUEST' (status=1)
2015-12-01 13:21:46 AUTH: Received control message: AUTH_FAILED
2015-12-01 13:21:46 SIGTERM[soft,auth-failure] received, process exiting
2015-12-01 13:21:46 MANAGEMENT: >STATE:1449004906,EXITING,auth-failure,,
2015-12-01 13:21:50 *Tunnelblick: Disconnecting; user cancelled authorization or there was an error obtaining authorization
What is in this client configuration? Does it contain a certificate or something? Can I make one myself?
I have the options checked to allow downloading of the client profiles from the UI, but as you can see from my screenshot, these options are not available to the user via the UI:
