Why the VPN Editor Will Not Save a New Profile

The Save button stays grey while every field looks filled in, and the gateway has not seen a single packet yet. Nothing has been rejected, because nothing has been sent. The control reflects what the local editor can verify about the profile in front of it. That is a narrower question than whether the account works, and it is answered without the network.

The Button Reflects Local Validation

A disabled control has more than one local cause, and they look identical from the outside. A required reference may be missing, a referenced file may be unreadable by the user running the editor, or the plugin that would handle the chosen method may not be installed at all. Permission problems on the profile itself produce the same grey button as an empty field.

Read the validation message before editing anything, because the message names the field the editor objects to. Guessing at the form is slower than reading the one sentence the editor already wrote.

Match the Fields to the Chosen Method

The required inputs follow from the connection method rather than from the dialog layout. A certificate identity needs a client certificate plus access to its matching private key, and it still needs a way to verify the server. An account-based method has different requirements and also needs server verification. Some deployments require both at once, which is why a form that seems redundant is often correct.

Use the operator's supported profile and enrollment instructions instead of assembling fields by intuition. Putting a client certificate into the CA field, treating a public certificate as a private key, or typing an account password into a private-key passphrase box are all common and all produce the same silent refusal to save.

Check each reference as the object it is meant to be. A filename with the right suffix proves nothing about readability, ownership or whether it belongs to this identity. A private key readable only by root will not load in a desktop session, and the editor reports that as a validation failure rather than as a permission error.

Changing the method purely to make the button clickable changes what the profile means. Typing junk passwords and then switching back can leave saved values behind that nobody intended. It also hides the requirement that was actually missing, which returns as a connection failure an hour later.

Separate Stored Secrets From Agent Secrets

Some information belongs in the saved profile and another credential may be supplied interactively at activation. NetworkManager's connection API keeps connection verification, secret verification and secret discovery as separate operations, and its own documentation warns that hints cannot always determine everything a connection needs.

That distinction explains a blank password field. It may be correct because a secret agent will supply the value, and it may be wrong because this connection has no agent available. The flags attached to a secret decide whether it is system-owned, agent-owned or not saved at all.

Pick the flag that matches the lifecycle. A desktop keyring unlocked after sign-in is not available to a service that starts before login, so a profile that works interactively can fail at boot without any change to the profile. That failure looks like a broken profile and is really a scheduling mismatch.

A successful save is not proof that the intended agent will answer the next prompt either. Keep ownership of the account and the private key intact rather than copying every secret into a system-readable file to make the dialog quiet.

Read the Later Stages Separately

Once the profile saves, inspect its identifier, endpoint, plugin and method without asking for secret values. An operator-supplied import can help, but importing is its own parser with its own supported features, so a rejected import is not the same failure as a rejected save.

Only then activate through the intended manager and the account it expects. A server-identity error, a rejected account, a missing route and a denied application permission all belong to later stages, and reporting them as an editor problem sends the investigation to the wrong place.

nmcli -f NAME,UUID,TYPE connection show
nmcli connection show "Corp VPN" | grep -E "vpn\.|802-1x"

If Save stays disabled with the documented inputs, record the editor version, the plugin version, the selected method and the exact local error. A report that names the valid profile the editor cannot represent is useful; a sequence of random credentials that briefly made the button clickable is not.