Drıftstack docs
Docs

.ovpn references an external ca/cert/key file (must be inline)

You might be here because: “paste an inline ca cert key block instead” · “references an external cert/key file the session cannot provide” · “my ovpn needs ca.crt and client.key files” · “ovpn refused, include the certificate inline” · “where do I upload the certificate files”

Short answer

Only the .ovpn text itself is sent to the session, so a line like ca ca.crt, cert client.crt, key client.key, tls-auth ta.key or tls-crypt … that points at a separate file cannot work — the file would never exist there. The config is refused naming the first such line; the fix is to paste the certificate or key inline as <ca>…</ca>, <cert>…</cert>, <key>…</key> blocks. There is no separate file upload for certificates.

Check first

  • Signed in and online? Proxies save to your account.
  • Read the exact refusal under the form — it names the line or field.

Likely causes and fixes

  1. Provider gave you a zip with several files. Ask the provider for a single “inline” / “unified” .ovpn, which most offer. Or build one yourself: open each referenced file and paste its contents between the matching tags (<ca> … </ca> etc.), then delete the ca ca.crt-style line.
  2. The app cannot auto-fix this. Unlike script lines, the desktop app does not invent missing material — after any auto-repair it still reports the file reference for you to edit.
  3. You pasted the key onto the key line itself. The refusal quotes only the directive, never what follows it, so key material is not echoed. Move it into a <key> block.
  4. Tag case matters. <CA> is not the ca block — OpenVPN matches tags case-sensitively, so use lowercase tags.

If it still fails

Press Talk to a person in this chat (or open Help) and include the refusal sentence and line number only — never the certificates, keys or the config. If the file has inline blocks and is still refused, a person should look.