[iOS] On Demand profiles added through Apple Configurator not working correctly

[bisko]

Setup:

• iPhone 6 / iOS 8.0.2
• OpenVPN Connect 1.0.5 (latest from AppStore? while writing this)
• OpenVPN OnDemand? profile added through Apple Configurator with certificates
• Profile works correctly, the phone manages to connect to it (it needs to be done in a certain way to work, more information below)

Problem:

• The profile shows in iOS and in OpenVPN Connect
• When going to Settings and toggling the VPN switch it says: "To connect using [profile name], use the OpenVPN application" and doesn't connect at all
• When going to OpenVPN Connect, the "on/off" button is greyed out and I cannot initiate the connection from there. I can see the profile there and it is chosen.
  • note: If I add a connection profile throguh *.ovpn file I can connect successfully from the OpenVPN application (not tested the Settings -> VPN switch).
• When trying to initiate the On Demand part of the profile by going to Safari and opening a domain mentioned in the OnDemand? domain list, the browser pops up an error "Unable to connect to server" for a second and then loads the domain through normal connection (wifi).
  • I suppose this happens because it tries to connect but it is unable to do so due to the error mentioned above.
• The only way the profile works is if I go to Settings -> General -> VPN and use the switch there. It connects correctly and I can see the connection in OpenVPN connect too. It is working as it should be working.

notes:

• It is possible that Apple changed something in the way it handles OpenVPN connections. The same configuration (different certificates) worked fine on iOS 7.1.2 on an iPhone 4 a week ago.

[bisko]

I forgot to add the form thread where the problem is mentioned too: ​https://forums.openvpn.net/topic17062.html

[Samuli Seppänen]

According to the ​forum thread the problem may have been fixed in iOS 8.3. Once we get confirmation we can close this ticket.

[Antonio Quartulli]

Closing this ticket as nobody has complained anymore.

Feel free to re-open it if the issue should persist.

Note that on v1.2.5 and v1.2.6 provisioning profiles need to use the unified format as PKCS#12 are temporary inaccessible due to Apple's restrictions.