Certificate Sign-In Setup

A certificate is a separate, independent credential from your account password. If you ever want to revoke access from one device without changing your account password everywhere else, a certificate makes that possible in the future -- and it can't be guessed or brute-forced the way a weak password can.

The certificate file is itself protected by a password so it can't be used if someone else gets hold of it. That password is randomly generated just for this download and shown to you once -- it's deliberately not your account password, so the two stay independent.

This almost always means the files were double-clicked instead of imported via PowerShell. Double-clicking imports certificates to the "Current User" store, but Windows' VPN connection needs them in the "Local Machine" store. Re-run the two Import commands from Step 3 above via PowerShell (as Administrator) to fix it.

This VPN currently tunnels IPv4 traffic only. If your internet connection also provides IPv6, sites that check over IPv6 can bypass the tunnel. Until IPv6 tunneling support is added, disable IPv6 on your network adapter: run Get-NetAdapter | Disable-NetAdapterBinding -ComponentID ms_tcpip6 in PowerShell as Administrator.

Certificates are issued with a limited lifetime for security. If yours has expired, go back to your VPN's dashboard page and download a new one -- it takes a minute and doesn't require anything from support.

This means "IPSec CA certificate" in the VPN profile is set to the PrivyNet CA certificate. That field is for validating the VPN server's own certificate, not the client CA -- it should be set to "(don't verify)", with IPSec server certificate left as "(received from server)". Selecting our client CA there causes Android to reject the server's certificate right after the connection looks like it's about to succeed. If you've been editing an existing profile's settings back and forth, delete it and create a fresh one afterward -- edited profiles can behave inconsistently even once the settings look correct.

This just means the profile isn't signed by a commercial certificate authority, which is normal for a self-hosted VPN and doesn't affect how it works. You can still install and connect normally.

Not yet -- certificate sign-in is currently verified on Windows, Android, and iOS. Use password sign-in (see the main VPN Configuration guide) on other platforms for now.