Replace the old Sophos SSL VPN Client and migrate startup

The old Sophos SSL VPN Client for Windows should no longer be installed or operated. It has been End of Life since January 31, 2022, all versions are affected by CVE-2021-36809, and Sophos does not provide a fix. Since SFOS 20.0 MR1, the legacy client also no longer establishes remote access SSL VPN tunnels.

The secure solution is to migrate to Sophos Connect: prepare a current profile and installer, uninstall the old client, import and test the connection, and then remove startup entries, plaintext files, and old profiles completely. For help choosing the right remote access model, see Sophos Connect or SSL VPN: Which solution fits?.

⚠️ If the affected device provides the only remote administrator access, arrange an alternative access method or a maintenance window with local access before uninstalling the client. The EOL client is not a secure fallback.

Migrate to Sophos Connect

1. Prepare the current Sophos Connect installer and a fresh .ovpn file from the VPN portal. The complete click paths are documented in Set up Sophos SSL VPN with Sophos Connect on Windows.
2. If the VPN portal is unavailable, copy only the existing .ovpn file from the legacy configuration folder to a protected temporary folder. Do not copy a password.txt file.
3. If the copied profile contains auth-user-pass password.txt, remove the filename from the copy so that only auth-user-pass remains.
4. Disconnect the VPN and uninstall the old Sophos SSL VPN Client normally under Settings > Apps > Installed apps. Do not manually delete unknown drivers or services.
5. Restart Windows, install Sophos Connect, and import the current .ovpn file or the cleaned profile copy using Import connection.
6. Establish the connection with the intended user and, if configured, MFA or SSO. Remove the remaining legacy artifacts only after a successful test.

Sophos Connect and its profiles should then be maintained through a defined update process. See Check and update the Sophos Connect Client version safely.

Identify legacy startup entries and plaintext credentials

Check startup and the Run value

In Task Manager, open Startup apps and look for SSL VPN Client for Windows, then disable the entry.

A custom startup value may also exist for the current user:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

A legacy value can be identified by openvpn-gui.exe, --config_dir, and --connect. The following pattern is for identification only and must not be created:

"C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpn-gui.exe" --config_dir "C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\config\" --connect <profile-name>.ovpn

Remove only the value that clearly belongs to the old Sophos client. Never delete the entire Run key or unknown entries. For older installations, also check the classic Windows Startup folder. In managed environments, determine whether a GPO or software deployment recreates the value.

Check the OVPN profile and password.txt

Legacy profiles are often stored in one of these locations:

• 64-bit Windows: C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\config\
• older 32-bit installations: C:\Program Files\Sophos\Sophos SSL VPN Client\config\

The actual Run value and local installation are more reliable than an assumed default path.

A problematic file reference looks like this:

auth-user-pass password.txt

The referenced file contains the username and password in plaintext. Do not open, display, or attach this file to support data. For the migration, leave only normal interactive authentication in a copy of the profile:

auth-user-pass

After Sophos Connect has been tested successfully, delete the referenced password file, any additional copies, and any legacy profiles that are no longer needed. Then change the affected account’s password in the responsible identity system and check the VPN logs for unexpected sign-ins. Deleting only the file is not sufficient.

Auto-connect without password.txt

A Sophos Connect provisioning file (.pro) can import and update profiles automatically. With auto_connect_host, the client checks a host that is reachable only on the internal network. If that host is unreachable, Sophos Connect enables the connection; the tunnel is established automatically only with saved credentials or after a previous SSO sign-in.

[
  {
    "display_name": "Company VPN",
    "gateway": "vpn.example.com",
    "vpn_portal_port": 443,
    "auto_connect_host": "intranet.corp.example",
    "can_save_credentials": false
  }
]

With can_save_credentials: false, the client does not store the user’s password. Without SSO, the user must still sign in. If SSO was the last sign-in method, Sophos Connect can establish the tunnel automatically using SSO. This example is intentionally minimal; classic Sophos Firewall OTP requires additional otp and 2fa fields. For the complete provisioning workflow, see Configure Sophos Connect on the firewall; for authentication, see MFA on Sophos Firewall or Microsoft Entra ID SSO for Sophos Connect.

Provisioning requires an accessible VPN portal. If it is exposed from the WAN, use a trusted certificate, MFA, monitoring, and the narrowest possible Device Access and Local Service ACL configuration.

Verify the migration and isolate errors

After the migration, check the connection and the cleanup separately:

• The old client, its Task Manager startup entry, and the specific HKCU Run value have been removed.
• No password.txt remains in the old profile path or software deployment.
• A migrated profile does not contain a file reference after auth-user-pass.
• Sophos Connect uses the intended current connection and client version.
• Authentication, MFA, or SSO works.
• The client receives an address from the expected VPN pool.
• Internal DNS names and permitted destinations work, while explicitly blocked networks remain blocked.
• Log Viewer shows the expected user and the correct remote access rule.

Sophos Connect cannot be installed

Check whether the old Sophos SSL VPN Client is still installed. Uninstall it normally, restart Windows, and try the installation again. If other VPN clients conflict, do not remove drivers or services speculatively.

The profile is imported, but the tunnel does not start

Import a current .ovpn file from the VPN portal again and check the policy assignment, user account, MFA, and Sophos Connect events. On the firewall, sslvpn.log, openvpn-status*.log, and, for authentication problems, access_server.log can help depending on the error.

The tunnel is connected, but internal destinations do not work

The problem is then usually related to the policy, firewall rule, DNS, routing, or MTU. Use Test a firewall rule with Log Viewer, Policy Test, and Packet Capture, Sophos Firewall services and logs, and, for stalled applications, MTU and MSS for VPN problems.

FAQ