SSL VPN (ocserv) config generator
Generates ocserv gateway configs, OpenConnect client profiles and clientless portal rules for TLS-based access over port 443.
The server side of an SSL VPN
443 is what firewalls let through
Used in the ocpasswd hint
ocserv gateway config
# /etc/ocserv/ocserv.conf — OpenConnect (AnyConnect-compatible) SSL VPN auth = "plain[passwd=/etc/ocserv/ocpasswd]" # For certificate auth instead: auth = "certificate" tcp-port = 443 udp-port = 443 run-as-user = ocserv run-as-group = ocserv socket-file = /run/ocserv.socket server-cert = /etc/ocserv/certs/server.crt server-key = /etc/ocserv/certs/server.key ca-cert = /etc/ocserv/certs/ca.crt isolate-workers = true max-clients = 64 max-same-clients = 2 rate-limit-ms = 100 server-stats-reset-time = 604800 keepalive = 32400 dpd = 90 mobile-dpd = 1800 switch-to-tcp-timeout = 25 try-mtu-discovery = true # TLS 1.2+ only — the older versions are disabled explicitly tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1" auth-timeout = 240 idle-timeout = 1200 mobile-idle-timeout = 2400 cookie-timeout = 300 deny-roaming = false device = vpns predictable-ips = true default-domain = example.com ipv4-network = 192.168.100.0 ipv4-netmask = 255.255.255.0 tunnel-all-dns = true dns = 1.1.1.1 dns = 1.0.0.1 ping-leases = false route = default cisco-client-compat = true dtls-legacy = false # Add users with: ocpasswd -c /etc/ocserv/ocpasswd username
Bring your own certificate
ocserv needs a TLS certificate for the gateway hostname — use Let's Encrypt or your internal CA. Browsers and AnyConnect clients both reject self-signed certificates by default.
Generated locally, stored nowhere
Keys and passwords come from your browser's crypto RNG. Nothing you type or generate is sent to a server, written to storage, or recoverable by anyone once you close this tab.