The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A usable OpenVPN backup is more than a server configuration file. It must include the certificate authority (CA), private keys, certificate database or Easy-RSA state, revocation list, TLS protection keys, client profiles, and the firewall, routing, and authentication settings outside OpenVPN. The exact files depend on whether you run a self-managed OpenVPN server or OpenVPN Access Server.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
Restore onto a clean, compatible host, stop the service before replacing files, restore the complete cryptographic state, reapply operating-system networking rules, and verify a real client connection. If the Easy-RSA CA private key or Access Server certificate database is missing, existing client identities generally cannot be preserved.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
First identify which OpenVPN deployment you run
OpenVPN has two materially different backup models. A self-managed installation normally reads text configuration files and uses Easy-RSA (or another external PKI) for certificates. OpenVPN Access Server stores most of its unique state in SQLite databases and also depends on its as.conf file. Mixing the procedures can produce a backup that looks complete but cannot restore the service.
Self-managed OpenVPN
This is the conventional community-server layout: a service such as openvpn-server@server loads one or more .conf files, while an Easy-RSA directory contains the CA and issued certificates. Paths differ by operating system and packaging, so preserve the paths referenced by your configuration rather than assuming a distribution default.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
OpenVPN Access Server
Access Server keeps global settings, certificates, users, and other state in SQLite databases by default. Its backup and recovery process is database-oriented, not a matter of copying one server configuration file.
What a self-managed OpenVPN backup must contain
Back up the complete set of files that the running service and its PKI depend on. A configuration-only archive can recreate syntax but not the identities, trust chain, or revocation decisions that clients rely on.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
| Artifact | Why it matters |
|---|---|
| OpenVPN server configuration and included files | Defines the listening address and port, protocol, tunnel device, address pool, authentication, routes, DNS behavior, certificate paths, and any included snippets. |
pki/ca.crt |
The CA certificate that clients use to validate the issuing authority. |
pki/private/ca.key |
The security-critical CA private key. It is required to preserve the existing trust chain and to issue or revoke certificates later. |
pki/index.txt |
Easy-RSA’s master database of issued certificates, including their status. |
pki/serial |
Certificate serial-number state needed for continued issuance. |
pki/issued/ |
Issued certificate files for the server and clients. |
pki/private/ |
Private keys for issued identities. Protect this directory as carefully as the CA key. |
pki/reqs/ |
Certificate-signing requests that may be needed for administration or re-issuance. |
pki/crl.pem, when used |
The current certificate-revocation list. Without it, a restored server can make different revoke/allow decisions from the original. |
| Server certificate and private key | Identifies the VPN endpoint to clients. These may be inside the PKI tree or stored at paths referenced by the configuration. |
ta.key or the configured TLS-crypt key |
Provides the TLS-authentication or TLS-crypt protection required during the handshake. |
| Diffie-Hellman parameters, if configured | Some older deployments require this file for key exchange. |
Client .ovpn profiles and embedded material |
Clients need the profile, CA certificate, client certificate, private key, and TLS-auth/TLS-crypt material specified by that profile. |
| Service-unit overrides and helper scripts | Systemd overrides, routing scripts, DNS hooks, and startup options can live outside the main configuration. |
| Firewall, NAT, and routing rules | These are usually maintained by the operating system or network appliance, not by OpenVPN itself. |
| External authentication settings | LDAP, RADIUS, PAM, database, or custom authentication files and secrets must be restored separately. |
Easy-RSA describes index.txt as the “master database” of all issued certificates. Treat the entire PKI directory as one consistent unit; do not restore certificates from one point in time with the CA database or CRL from another.
What to back up from OpenVPN Access Server
Access Server’s official backup tutorial identifies the following files in its database directory. The exact list varies by release, so record the version and inspect the installation rather than assuming an older layout.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
| File | Contents or role |
|---|---|
config.db |
Global Access Server configuration. |
certs.db |
Server and client certificate information. This is indispensable for preserving existing client identities. |
userprop.db |
User and group properties. |
log.db |
Access Server logs and related history. |
as.conf |
Low-level Access Server settings outside the databases. |
config_local.db |
Present on newer releases or particular installations; include it when present. |
cluster.db and notification.db |
Deployment-specific databases that may exist on newer or clustered installations. |
Use the SQLite dump procedure documented for your Access Server release from the database directory. Copy every resulting .bak dump and as.conf to protected storage. Keep the original Access Server version, operating-system details, hostname assumptions, and the list of included databases alongside the archive. OpenVPN states that these files contain everything unique about an installation and can be restored to another Access Server, including a higher version, subject to compatibility.
Design a backup that can actually be recovered
Automate recurring captures
Run backups on a schedule rather than after a configuration change. OpenVPN recommends regular, automated backups and specifically describes using a cron-managed task for unattended Access Server backups. Schedule the job when database activity is predictable, capture success or failure in monitoring, and periodically verify that a new archive was created.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Keep an off-host, tamper-resistant copy
At least one copy should live outside the VPN host. A disk failure, ransomware event, or administrator error that affects the server must not also destroy every backup. Encrypt archives in transit and at rest, restrict access to CA and server private keys, and retain a recovery copy that the production host cannot silently alter.
Back up the encryption key separately
An encrypted archive whose decryption key is stored only on the failed host is not a recovery copy. Document where the key is held, which role is authorized to use it, and how emergency access is approved. Never place a CA private key or client private keys in an unrestricted shared folder.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Maintain a manifest
For each backup, record the deployment type, OpenVPN or Access Server version, operating-system release, source paths, included databases, archive timestamp, encryption-key identifier, and external dependencies such as firewall rules or an authentication provider. A manifest turns an opaque archive into a recoverable package.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsBack up a self-managed OpenVPN server
- Inventory the live configuration. Identify every server configuration file and every
includeor referenced path. Record the service unit, listening port, tunnel network, address-pool settings, routes, DNS integration, and authentication method. - Stop and quiesce changes when consistency matters. For a planned capture, pause certificate issuance or revocation while copying the PKI so that
index.txt, serial state, certificates, andcrl.pemdescribe the same point in time. - Copy the complete PKI tree. Include
pki/ca.crt,pki/private/ca.key,pki/index.txt,pki/serial,pki/issued/,pki/private/,pki/reqs/, andpki/crl.pemwhen used. Do not omit a directory because it appears empty today. - Copy operational key material. Preserve the server certificate and key,
ta.keyor TLS-crypt key, Diffie-Hellman parameters when configured, and any external-PKI files. Preserve client profiles, including embedded certificates and keys. - Capture operating-system dependencies. Export or document firewall and NAT rules, forwarding settings, route scripts, DNS hooks, service-unit overrides, and external-authentication configuration. These settings may not be in the OpenVPN directory.
- Encrypt, transfer, and verify the archive. Store it off-host, confirm that the archive can be decrypted by an authorized recovery operator, and compare the manifest with the files actually copied.
Back up OpenVPN Access Server
- Record the release and host details. Note the Access Server version, operating-system family, architecture, hostname or address assumptions, and whether the installation is clustered.
- Locate the Access Server database directory. Confirm which of
config.db,certs.db,userprop.db,log.db,as.conf,config_local.db,cluster.db, andnotification.dbexist on that release. - Run the documented SQLite dump process. Follow the Access Server backup tutorial for the installed version and create the corresponding
.bakfiles. A raw file copy taken during an active database write is not a substitute for a consistent dump. - Copy every dump and
as.conf. Includecerts.db; omitting it can destroy the relationship between existing clients and the server’s unique certificates. - Protect and test the archive. Encrypt the dumps, move them to off-host storage, record the database list and version, and perform a test restore on a non-production host when possible.
Restore a self-managed server after disk failure
- Provision a clean host. Use the same operating-system family and a compatible OpenVPN release. Recreate required packages, network interfaces, hostname assumptions, and time synchronization.
- Install but do not start the VPN service. Starting with an empty PKI can create new files or permissions that complicate recovery. Stop the service before replacing configuration, certificates, keys, or scripts.
- Restore configuration paths. Put the server configuration and included files at the paths referenced by the service. Restore the complete Easy-RSA tree, not just the server certificate.
- Restore ownership and permissions. The service account must be able to read required keys, while private keys and CA material remain inaccessible to ordinary users. Match the restrictive permissions used by the original host.
- Reapply external networking. Restore IP forwarding, firewall and NAT rules, routes, DNS integration, service-unit overrides, and authentication providers. A successful daemon start does not prove that packets can reach the protected network.
- Start the service and inspect logs immediately. Look for configuration parse errors, missing files, permission denials, certificate-chain failures, TLS-authentication errors, and route or plugin failures.
- Test an existing client profile. Use a profile from before the outage. Confirm that the original client certificate validates, the TLS-auth or TLS-crypt exchange succeeds, an address is assigned, expected routes and DNS are received, and required internal services are reachable.
Restore OpenVPN Access Server
- Build a compatible replacement host. Install the same operating-system family and a compatible Access Server release. The official procedure allows restoration to another Access Server, including a higher version, subject to compatibility; do not assume every version jump is safe without checking release requirements.
- Stop Access Server before replacement. Do not overwrite databases while the service is running. Stop all relevant Access Server components before restoring dumps and
as.conf. - Restore every database in the backup set. Follow the SQLite recovery procedure for the release and restore
config.db,certs.db,userprop.db,log.db, and any includedconfig_local.db,cluster.db, ornotification.db. Restoreas.confas documented. - Recreate outside dependencies. Apply firewall, NAT, routing, DNS, identity-provider, and host-level settings that are not contained in the Access Server databases.
- Start and review logs. Check for database-open failures, schema or version errors, unreadable files, certificate problems, and authentication-provider errors before allowing normal users back.
- Reconnect a real client. Test an existing profile, not only the administrator console. Validate certificate acceptance, revocation behavior, address assignment, routes, DNS, and access to internal networks.
Will existing client certificates still work?
Self-managed deployment
They should continue to work when the original CA certificate, CA private key, certificate database state, issued certificates, server key pair, TLS protection key, and current CRL are restored consistently. Do not run Easy-RSA initialization to “repair” the host: generating a new CA changes the trust chain, so old client certificates will no longer authenticate to that new authority. If a CA key is intentionally lost, plan for a new PKI and reissue every client certificate.
Access Server
Preserving certs.db is critical. OpenVPN states: “Each installation of Access Server has unique certificates, and if you lose this information without a backup, you must completely reinstall Access Server and the VPN clients.” In practical terms, losing that database can require reinstalling both the server and client software or profiles, even if other configuration files survive.
Quick Recap
Validate the restored security state, not just the daemon
- Certificate dates: Confirm that the server and test client certificates are currently valid and that the replacement host’s clock is roughly synchronized. OpenVPN community guidance warns that significant clock differences can make certificates fail.
- CRL enforcement: Confirm that the restored CRL is the current one. Easy-RSA’s
gen-crloperation creates an updated revocation list, and that list must be delivered to every system that references it. Where your policy permits, test a deliberately revoked identity and verify rejection. - TLS protection: Verify negotiation with the restored
ta.keyor TLS-crypt key. A client profile that contains a different key should fail rather than silently connect. - Addressing and routes: Check tunnel address assignment, pushed routes, return routes, split-tunnel behavior, and access to each required internal network.
- DNS: Test both internal name resolution through the tunnel and ordinary resolution outside it, according to your design.
- Firewall and NAT: Confirm forwarding in both directions, masquerading or return routes, and restrictions that should remain in force.
- Logs: Correlate client connection time with server logs. Look for authentication, certificate, database, permission, and packet-forwarding errors rather than relying on a green service status alone.
Common recovery failures and their fixes
| Symptom | Likely omission | Corrective action |
|---|---|---|
| Clients reject the server certificate | Wrong CA, regenerated CA, missing server certificate, or incorrect file path. | Restore the original CA and server key pair and check the configuration’s referenced paths. Do not generate a replacement CA unless reissuing clients is intended. |
| Previously working clients are unknown or require enrollment | Access Server certs.db or self-managed issued-certificate and index state was not restored. |
Restore the matching certificate database or complete PKI snapshot. If the unique Access Server certificate data is gone, prepare for server and client reinstallation. |
| Revoked clients connect | Missing, stale, or incorrectly referenced crl.pem. |
Restore the current CRL, ensure the configuration references it, reload the service, and test revocation. |
| TLS negotiation fails immediately | Missing or mismatched ta.key/TLS-crypt key or incompatible client profile. |
Restore the original key and verify that clients use the corresponding profile material. |
| The service starts but internal systems are unreachable | Firewall, NAT, forwarding, routes, or DNS settings were outside the archive. | Reapply host and network-device rules, then test routes and return traffic from an actual client. |
| Certificates appear invalid after restore | Host clocks are substantially different. | Synchronize time on the server and clients, then retry validation. |
| Access Server reports database errors | Incomplete dump set, wrong restore order or location, active service during replacement, or version incompatibility. | Stop Access Server, restore every database included in the manifest and as.conf using the release-specific procedure, and review startup logs. |
Choosing a backup approach
| Decision axis | Self-managed OpenVPN | OpenVPN Access Server |
|---|---|---|
| Primary state | Configuration files plus an Easy-RSA or external PKI directory. | SQLite databases plus as.conf. |
| Most dangerous omission | pki/private/ca.key and matching certificate/index state. |
certs.db. |
| Cryptographic completeness | CA, server and client keys, certificates, CRL, TLS key, and any Diffie-Hellman parameters. | Certificate data held by Access Server, including the certificates database and related configuration. |
| External dependencies | Firewall, NAT, routes, DNS, service overrides, and authentication settings. | Host networking, DNS, firewall, NAT, and identity-provider settings outside the databases. |
| Automation | Scheduled, encrypted file/archive capture with manifest and restore tests. | Scheduled SQLite dumps, protected off-host storage, and version-aware restore testing. |
| Recovery proof | Existing client profile connects and CRL behavior is correct. | Existing client profile connects and restored certificate records remain usable. |
Recovery checklist
- Deployment type and software version are recorded.
- Configuration, included files, PKI or Access Server databases, and
as.confare listed in a manifest. - CA and server private keys are encrypted and access-controlled.
- At least one backup is stored off-host and cannot be modified by the production server.
- Archive decryption has been tested by an authorized recovery operator.
- Firewall, NAT, forwarding, routes, DNS, service overrides, and external authentication are documented.
- A clean compatible host can be provisioned without starting the service prematurely.
- A real client test covers certificate validation, CRL rejection, TLS protection, addressing, routes, DNS, and internal access.
- Logs from the restored service and client are retained with the recovery record.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
