OpenVPN Connect on Mac: list imported profiles from the CLI

The list of imported connections is available from the application itself, not from a folder inside Application Support. OpenVPN Connect for macOS exposes command-line flags that query its own profile store, which means the answer comes from the same model the GUI uses. That is why the documented list beats any directory you find by browsing. It also explains why the folder is not a substitute for it.

What the command reads is a small record per imported profile: an identifier, a display name, a host, a profile type, the stored user name and any server override. Everything else about the connection lives behind that record. The record is the inventory, and it is deliberately narrow.

What the CLI flags actually reach

The Mac command-line guide documents --version and --list-profiles against the OpenVPN Connect executable. The path in the documentation is a placeholder, and it has to be replaced with the binary inside the installed application package. Quote that path, because application bundle names usually contain spaces.

That binary is not the openvpn executable from Homebrew. They are different programs with different flags, and running the community client's help output against a Connect question produces a confident wrong answer.

Run the query in the context of the user whose profiles you want to inspect. A profile store is per-user state, so an administrator shell may see a different inventory or none at all. If the list is empty while the GUI clearly shows a connection, that mismatch is the first thing to check.

Read the record, not just the name

The listed fields exist to disambiguate entries that look alike. Two profiles can share a display name and still point at different hosts, and the identifier is what distinguishes them when you write down the one you mean. Record the ID next to the name, not instead of it.

The type field tells you how the profile authenticates: autologin, user-locked or server-locked. That classification explains which credential the app will ask for and whether a connection can start without a person present.

Hostname and server override are the routing facts. A familiar name plus an override to a staging host is a different connection from the same name with no override, and only the record shows the difference. Compare the override before you compare anything else. It is the field most often left behind when a profile is recreated by hand.

Why the storage folder is a poor substitute

The directory under Application Support is private storage, not a documented interface. Its layout can change between releases, and the files inside it are only meaningful to the application that wrote them.

Copying that folder to another Mac carries the files but not the context they depend on. Keychain entries, the enrolled user and the application's own bookkeeping are separate, so a copied folder can appear in place and still fail to connect. A migration that looks complete and does not connect is worse than one that refuses to start.

Treat the folder as a backup of unknown value rather than a migration format. If you need to move a connection, move a source profile the server issued, not a slice of another installation's state.

What the inventory cannot tell you

The list does not export a portable .ovpn file, and it does not hand back the credentials or certificates the app holds. It reports that a profile exists and what it targets. How to recreate it elsewhere is a separate question with a separate answer.

For migration, obtain the approved original profile or the current server download, then import it through the supported workflow. The documented import flag takes a source file; the export direction is not part of that interface.

Keep the inventory output clean

The output can contain internal hostnames and account identifiers. Treat it like any other inventory export, and redact the host and user fields before sharing a screenshot.

Inspection does not require an import switch or a password. If a command you were given asks for credentials merely to list profiles, stop and check the documented flags. The list is a read-only query, and it should stay one.