Sophos Firewall: .ovpn missing or 0 bytes

When the Sophos Firewall VPN Portal does not provide a usable .ovpn file, first identify the exact symptom. Three cases may look similar but have different causes:

The download is completely missing: In most cases, the user is not assigned to a suitable SSL VPN policy, or the expected group membership does not apply.
The download is visible, but the file is 0 bytes or contains only an error message: Profile generation or delivery has failed. Certificate generation, logs, firmware version and, with HA, the active node are then relevant.
The file is not empty, but an existing connection no longer works: This is normally not a download error. After changes to Protocol, SSL server certificate, Override hostname, or Port, a current profile must be imported.

This distinction prevents unnecessary intervention. In particular, do not renew the Default CA on suspicion or run old repair commands from Community posts.

Classify the Symptom in the VPN Portal

For the initial check, sign in to the VPN Portal as the affected user and open VPN > VPN configuration. Then document four results separately: portal reachable, sign-in successful, SSL VPN entry visible, and downloaded file size.

A comparison with a working reference user from the same SSL VPN policy provides the most useful evidence:

Note the exact test time and affected username.
Check whether the SSL VPN download appears under VPN configuration.
Download the file and check its size in the operating system.
Repeat the same process with a known working user.
Record whether the error affects only one user, one group, or all users.

If the reference user works, the cause is more likely related to policy assignment, group, User ID, or certificate generation for the individual user. If the download fails for everyone, the shared SSL VPN certificate, storage, patterns, firmware and, with HA, the active node become more likely causes.

An .ovpn file may contain certificate and key material. Its contents do not belong in screenshots, emails, or support tickets. The file name, size, time, and visible error message are sufficient for diagnosis.

If portal access or sign-in already fails, the problem occurs before profile generation. Check Administration > Device access, VPN Portal authentication, and vpnportal.log or access_server.log. Set up SSL VPN Remote Access describes the complete firewall configuration.

When the .ovpn File Is Completely Missing

The firewall shows SSL VPN configurations only to users assigned to a Remote Access SSL VPN policy. A successful portal sign-in alone does not prove this authorization.

Check the Policy and Group Membership

Open Remote access VPN > SSL VPN.
Edit the expected policy.
Under Policy members, check whether the user or their actual group is listed.
Under Authentication > Users or Authentication > Groups, verify the group membership.
Sign in to the VPN Portal again as the affected user and reopen VPN configuration.

A user may sign in successfully through another portal permission and still receive no SSL VPN configuration. Guest users and guest groups are not valid policy members for Remote Access SSL VPN. When identical direct user or group members are assigned to multiple policies, Sophos Firewall removes them from the earlier policy when the newer policy is saved. Therefore, check the Policy members that actually remain and any overlapping group memberships.

Only New or Individual Users Are Affected

Also check the internal User ID under Authentication > Users > Show additional properties. Sophos Firewall supports user and group IDs only up to 65535. A higher ID can prevent the download; Sophos Firewall User-ID Limit explains the safe check and cleanup process.

A demonstrably successful VPN Portal sign-in argues against the User-ID limit as the primary cause. The visible ID of the affected account remains decisive, not the number of users in the list.

Also check the username and the subject fields of the certificate and CA for special characters. For this process, Sophos recommends ASCII usernames and no UTF-8 characters in certificate or CA fields. The username becomes part of the .ovpn file name and the certificate generated for each user. A working test user with a simple ASCII name helps narrow down the issue; do not spontaneously rename production AD or Entra identities for this purpose.

When the Download Is 0 Bytes or Is Not Generated

An empty file means that the download link exists, but generation or delivery did not produce a usable configuration. Sophos identifies incomplete certificate or CA configurations as a possible cause. Before regenerating anything, save the logs and system state.

Save Logs at the Exact Test Time

Under Diagnostics > Tools > Troubleshooting logs, the relevant files can be downloaded without entering the Advanced Shell. Depending on the error stage, the following logs are important:

vpnportal.log for the request in the VPN Portal;
access_server.log for normal authentication;
oauth_sso_vpn.log for Microsoft Entra ID SSO;
peruser_cert_sslvpn.log for user-specific certificate generation;
vpncertificate.log for certificates and Certificate Authorities;
sslvpn.log for the SSL VPN service.

Filter the logs by the previously recorded test time and username. If the portal and authentication succeed but peruser_cert_sslvpn.log reports an error at the same time, the certificate and CA are the next useful check. If the problem has affected all users only since an upgrade or HA failover, also document the firmware version, active node, and time of the role change. Sophos Firewall services and logs explains how to classify additional files.

Check Temporary Storage

A full temporary partition can also prevent profile generation. After signing in to Sophos Firewall through SSH, open 5 Device Management > 3 Advanced Shell and display the available space:

df -kh /tmp

The relevant values are Avail and Use% for the file system that contains /tmp. If practically no space remains, do not manually delete unknown files. Instead, save logs and system state and determine which process is consuming the storage. Sophos previously fixed an issue under NC-142397 in which SSL VPN filled the /tmp partition. The bug ID is therefore a version indicator, but not an automatic diagnosis for current builds.

Check the SSL VPN Certificate and Signing CA

Under Remote access VPN > SSL VPN > SSL VPN global settings, the SSL server certificate field shows which certificate the firewall uses for the SSL VPN tunnel. Do not confuse this certificate with the HTTPS certificate for the VPN Portal under Administration > Admin and user settings.

Classify Public Certificate Lifetimes Correctly

The announced reduction of publicly trusted TLS certificate lifetimes to as little as 47 days does not automatically affect the per-user X.509 certificates embedded in the .ovpn file. By default, the internal SFOS CA signs them, so they are not part of the public Web PKI. This does not require monthly profile downloads or a switch to a public CA.

The HTTPS certificate of the VPN Portal and the tunnel’s SSL server certificate continue to serve separate roles. The portal certificate must be renewed in time because the portal is a browser-facing service; an automatically renewed Let’s Encrypt certificate can be appropriate. A change to Protocol, SSL server certificate, Override hostname, or Port still becomes reliable only after downloading and importing a new .ovpn file. This distinction prevents an unnecessary rebuild of the internal SSL VPN PKI because public lifetimes become shorter.

Then check the following under Certificates > Certificates and Certificates > Certificate authorities:

Is the selected SSL server certificate present and still valid?
Is its issuing CA present and trusted?
For an external certificate, was the complete chain of Intermediate and Root CAs imported?
Does the time of the error correspond to a certificate change, restore, or migration?

By default, the firewall uses the built-in ApplianceCertificate, which is signed by the Default CA. This explains the normal dependency but does not yet prove which certificate object is causing the specific error. In particular, an error in peruser_cert_sslvpn.log must not automatically be interpreted as a defective ApplianceCertificate.

For a 0-byte file, Sophos recommends checking the signing CA that is actually used and the affected certificate generated by it. However, the specific repair differs by certificate:

ApplianceCertificate: Sophos documents the Regenerate action under Certificates > Certificates only for this built-in certificate. Use it only if ApplianceCertificate is selected as the SSL server certificate and a log message or Sophos Support confirms that it is affected.
External SSL server certificate: Check the certificate, private key, Intermediate CA, and Root CA as a coherent chain and, when supported by a conclusive error message, reimport them in a controlled manner. There is no universal Regenerate step in this case.
User-specific SSL VPN certificate: An error in peruser_cert_sslvpn.log does not automatically affect the SSL server certificate. Sophos currently documents no general UI process for resetting this user certificate. Therefore, provide the saved logs to Sophos Support; do not adopt old shell or database instructions.

Once the affected object has been clearly identified, perform the repair in a controlled manner:

Create a current firewall backup.
Document the selected SSL server certificate, issuing CA, specific log message, and services that use it.
Perform the appropriate action from the three cases during a maintenance window; if the case is not clear, escalate to Sophos Support.
Download a new .ovpn for a pilot user, import it, and test the tunnel.
Only after a successful pilot test, distribute new profiles to all affected users and check other affected services.

⚠️ Do not edit the Default CA on suspicion instead. Saving it regenerates this CA. That can affect significantly more certificates and trust relationships than the individual SSL VPN server certificate. Renew the Sophos Firewall Default CA safely explains inventory, the maintenance window, profile migration, and recovery.

Check Patterns, Firmware, and HA

Under Backup & firmware > Pattern updates, automatically installed components should show a current timestamp and Success. A single manual retrieval with Update pattern now is useful when a pattern error is visible; repeated clicking does not replace diagnosis. Configure and check pattern updates describes the complete process.

The exact firmware build is also part of the assessment. Sophos lists NC-149642—users could not download the SSL VPN configuration from the VPN Portal—under the resolved issues for SFOS 21.0 MR2 Build 349 and SFOS 22.0 GA Build 411. Other older fixes concerned downloads after upgrades or HA failovers. A historical bug ID does not prove the current cause, but it shows why an outdated build should be compared with the release notes before deeper repairs. Plan an update rather than improvising it during active troubleshooting; see Update Sophos Firewall SFOS firmware.

In an HA cluster, record the role, active node, and time of the last failover. If the error started only after a role change, save the VPN and HA logs from the affected node. Do not manually repair internal directories, database entries, or symbolic links under /content/sslvpn. Escalate such intervention to Sophos Support together with the saved error details.

When the File Exists but Is Outdated

A nonempty .ovpn file may have been generated correctly but no longer match the current firewall state. After changes to Protocol, SSL server certificate, Override hostname, or Port, download the file again and import it into the client. If Override hostname is empty, the enabled interface addresses may appear in the profile; a changed profile must also be downloaded again in this case.

Changes to Policy members or Permitted network resources, however, normally require only a new connection. A .pro provisioning file automatically downloads the available configuration; during diagnosis, still check separately whether the manual .ovpn download works.

With Microsoft Entra ID SSO, select the same Entra ID server under Authentication > Services for VPN portal authentication methods and SSL VPN authentication methods. Then download the .ovpn again. If a .pro file also provisions IPsec, check VPN (IPsec/dial-in/L2TP/PPTP) authentication methods with the same server as well. Microsoft Entra ID SSO for Sophos Connect and VPN Portal describes the complete dependency.

Verify the Result and Escalate Cleanly

The error is resolved only when the same process works completely with a normal pilot user:

Sign-in to the VPN Portal is successful.
The expected SSL VPN entry is visible under VPN configuration.
The downloaded .ovpn is not empty and contains no error message.
The new profile can be imported into the intended client.
The tunnel is established and receives an address from the expected SSL VPN pool.
An allowed internal destination works by IP address and hostname.
An intentionally disallowed destination remains blocked.

If generation remains faulty on a current firmware version, the support package should include at least the model, firmware build, HA role, error time, user and group, affected policy, file size, visible error message, recent changes, and the logs listed above. Do not include the actual .ovpn file. For a reproducible case, this evidence is more valuable than risky changes to internal files.