> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Download the client connection profile (.ovpn file)

> Steps to download a user-locked or auto-login connection profile via the OpenVPN Access Server Web UI.

<Note>These steps are typically performed by the **OpenVPN Access Server Admin**. See [Underlying Responsibility Roles](./Before_you_start#underlying-responsibility-roles) for more information.</Note>

In this section, we'll download a user-locked or auto-login connection profile for an existing user. If you need to create a new user, please refer to OpenVPN's documentation, which covers
[**Creating Users and User Groups for VPN Connections**](https://openvpn.net/as-docs/users-and-groups.html).

## Admin Web UI Method

<Steps>
  <Step>
    Log in to the OpenVPN Access Server Admin Web UI.

    Example: `https://<HOSTNAME_OR_IP>:943/admin`

    Port **943** is the default port for the OpenVPN Access Server Admin Web UI.
  </Step>

  <Step>
    On the left-hand menu, navigate to **Users**.
  </Step>

  <Step>
    On the line for the user you want to download the profile for, click on the **More actions (3 vertical dots)** button > **Download profile**.
  </Step>

  <Step>
    In the **Generate new client connection profile** menu:

    * Select the **Profile type**:
      * **User-locked**: The profile is locked to the user and cannot be used by any other user. This is the default option.
      * **Auto-login**: The profile contains the user's credentials and can be used by anyone who has access to the file. This option is not recommended for security reasons.
    * Add a comment if desired.
    * Click on **Download**.
  </Step>

  <Step>
    The `.ovpn` file will be downloaded to your local machine.
  </Step>
</Steps>

## Admin CLI Method (sacli)

<Steps>
  <Step>
    Connect to your Access Server via SSH and get root privileges.

    ```bash theme={null}
    ssh your-access-server
    sudo -i
    ```
  </Step>

  <Step>
    Create a new Client Profile for your VPN user:

    ```bash theme={null}
    /usr/local/openvpn_as/scripts/sacli --prefer-tls-crypt-v2 --user futurex_user GetUserlogin > futurex_profile.ovpn
    ```

    Replace `futurex_user` with the actual VPN username and `futurex_profile` with your desired profile name.

    <Note>
      The `--prefer-tls-crypt-v2` flag enables TLS crypt v2 for improved security. This is recommended for all new client profiles.
    </Note>
  </Step>
</Steps>