Using the iOS keychain to store your private key has the added security advantage of leveraging on the hardware-backed keystores that exist on many iOS devices, allowing the key to be protected by the iOS-level device password, and preventing key compromise even if the device is rooted.

If you already have your client certificate and private key bundled into a PKCS#12 file (extension .p12 or .pfx), you can import it into the app private section of the iOS Keychain using Mail, Safari or iTunes. Note sure that the file extension has to be changed to .ovpn12 for the file to be picked up by the OpenVPN Connect App (and not by iOS).

Note that on iOS, when you import a PKCS#12 file into the Keychain, only the client certificate and private key are imported. The CA (certificate authority) certificates are NOT imported (unless you manually extract the CA certificates and import them separately, one-at-a-time). How to generate private key and CSR from command line This article describes how to generate a private key and CSR (Certificate Signing Request) from the command line. You may need to do this if you want to obtain an SSL certificate for a system that does not include cPanel access, such as a dedicated server or unmanaged VPS. How to generate a certificate signing request and key pair in macOS Keychain Access. Export Certificates and Private Key from a PKCS#12 File with OpenSSL March 3. A Push Notification Certificate is necessary in order to send push notifications to attendees via your app. In order to create a Push Notification Certificate, follow the steps below.

Note that on iOS, when you import a PKCS#12 file into the Keychain, only the client certificate and private key are imported. The CA (certificate authority) certificates are NOT imported (unless you manually extract the CA certificates and import them separately, one-at-a-time). /vmware-workstation-12-key-generator.html. Therefore, the CA list must be given in the profile using the ca directive. If you already have a PKCS#12 file, the CA list may be extracted from the file using this openssl command, where the CA certs in client.p12 are written to ca.crt:

Generate Private Key From Certificate Ios 10

Then add a reference to ca.crt to your profile:

or paste the contents of ca.crt directly into your profile:

If you don't have a PKCS#12 file, you can convert your certificate and key files into PKCS#12 form using this opensslcommand (where cert, key, and ca are your client certificate, client key, and root CA files).

Then import the client.ovpn12 file from the previous step into the app using Mail or Safari.

Once this is done, remove the cert and key directives from your .ovpn file and re-import it, making sure that the cadirective remains. Once imported, any profile that lacks cert and key directives will cause a Certificate row to appear on the main view, allowing the profile to be linked with an Identity from the iOS Keychain (on iOS, an Identity refers to a certificate/private-key pair that was previously imported using a PKCS#12 file). Touch the Certificate row and select the MyClient certificate. At this point, you should be able to connect normally.

Generate Private Key From Certificate Ios 7

Note that the iOS Keychain is accessible by the app only after the user has unlocked the device at least once after restart. For this reason a profile requiring a certificate stored in the Keychain to connect won't be able to do so automatically after restart.
This is a security measure to prevent an unknown person to access a VPN network using a device that was previously switched off.