OpenConnect VPN client.
Description: VPN client compatible with Cisco AnyConnect SSL VPN
Keywords: OpenConnect, AnyConnect, Cisco, VPN, SSLVPN, SSL VPN

Home Features Getting Started Mailing List / Help Contribute Protocols VPN Server

OpenConnect VPN client

About Supported Platforms Download Packages Changelog

# Download

Released versions of OpenConnect are available from the FTP site:

- `ftp://ftp.infradead.org/pub/openconnect/`

Release tarballs (since 3.13) are signed with the PGP key with fingerprint BE07 D9FD 5480 9AB2 C4B0 FF5F 6376 2CDA 67E2 F359.

The latest release is OpenConnect v7.08 (PGP signature), released on 2016-12-13 with the following changelog:

- Add SHA256 support for server cert hashes.
- Enable DHE ciphers for Cisco DTLS.
- Increase initial oNCP configuration buffer size.
- Reopen `CONIN$` when stdin is redirected on Windows.
- Improve support for point-to-point routing on Windows.
- Check for non-resumed DTLS sessions which may indicate a MiTM attack.
- Add `TUNIDX` environment variable on Windows.
- Fix compatibility with Pulse Secure 8.2R5.
- Fix IPv6 support in Solaris.
- Support DTLS automatic negotiation.
- Support `--key-password` for GnuTLS PKCS#11 PIN.
- Support automatic DTLS MTU detection with OpenSSL.
- Drop support for combined GnuTLS/OpenSSL build.
- Update OpenSSL to allow TLSv1.2, improve compatibility options.
- Remove `--no-cert-check` option. It was being (mis)used.
- Fix OpenSSL support for PKCS#11 EC keys without public key.
- Support for final OpenSSL 1.1 release.
- Fix polling/retry on "tun" socket when buffers full.
- Fix AnyConnect server-side MTU setting.
- Fix ESP replay detection.
- Allow build with LibreSSL (for fetishists only; do not use this as DTLS is broken).
- Add certificate torture test suite.
- Support PKCS#11 PIN via `pin-value=` and `--key-password` for OpenSSL.
- Fix integer overflow issues with ESP packet replay detection.
- Add `--pass-tos` option as in OpenVPN.
- Support rôle selection form in Juniper VPN.
- Support DER-format certificates, add certificate format torture tests.
- For OpenSSL >= 1.0.2, fix certificate validation when only an intermediate CA is specified with the `--cafile` option.
- Support Juniper "Pre Sign-in Message".

For older releases and change logs, see the changelog page.

(Note: Due to a longstanding Fedora bug you may occasionally find that the FTP server is accessible only by IPv6 and not Legacy IP. If this happens, please let me know by sending me an email. Or just join us in the 21st century and get IPv6.)

## Latest sources

The latest source code is available from the git repository at:

- `git://git.infradead.org/users/dwmw2/openconnect.git`
  or browseable in gitweb at:
- http://git.infradead.org/users/dwmw2/openconnect.git