VPN configuration profile installation failed on macOS Tahoe 26.1

Question

acky_larkham Author

Level 1

24 points

VPN configuration profile installation failed on macOS Tahoe 26.1

When I install the VPN configuration profile, the following error occurred :

Profile installation failed.

The “VPN Service” payload could not be installed. The VPN service could not be created.

If you are aware of any workarounds or alternative methods, I would be grateful if you could advise.

Operating Environment

MacBook Pro 2023

macOS Tahoe 26.1

Configuration Profile

VPN configuration profile (.mobileconfig) created using Apple Configurator.

No syntax errors or other issues were found in the configuration profile's XML.

This configuration profile was installed without issue on macOS versions prior to Tahoe 26.1.

Furthermore, after installing this configuration profile, updating macOS to Tahoe 26.1 still allows VPN connections to function correctly.

MacBook Pro 14″, macOS 26.1

Posted on Nov 19, 2025 8:21 PM

Reply

Answer 1

acky_larkham Author

Level 1

24 points

Nov 19, 2025 8:59 PM in response to BobTheFisherman

I cannot find any configuration profiles in Apple Configurator that depend on the macOS version. Also when I recreate the configuration profile using Apple Configurator on macOS Tahoe 26.1 and install, the same error occurs.

Reply

Answer 2

Atrox1

Level 1

14 points

Nov 25, 2025 2:49 PM in response to BobTheFisherman

I have the same issue with macos tahoe, lots of people have this exact issue, they are all related and started to happen only after the update to tahoe. Also the exact DoH profile or VPN profile is installed on my iPhone 12 gives no errors but on tahoe it gives "The “VPN Service” payload could not be installed. The VPN service could not be created.":

Cannot install DNS over HTTPS (DoH) profi… - Apple Community

https://discuss.privacyguides.net/t/psa-macos-26-1-broke-setting-encrypted-dns-servers-via-mobileconfig/32712/6

https://help.nextdns.io/t/83y1waa/macos-the-vpn-service-payload-could-not-be-installed

Reply

Answer 3

Nov 19, 2025 8:24 PM in response to acky_larkham

If this is a VPN necessary to connect to your workplace network, contact the network IT staff for instructions. Otherwise let us know why you are installing a VPN.

Reply

Answer 4

acky_larkham Author

Level 1

24 points

Nov 19, 2025 8:35 PM in response to BobTheFisherman

Thank you for replying. I require a VPN to connect to my workplace network. I have already contacted the network administrator. However, the cause and solution have not been identified. This configuration profile is proven to work, but this is the first time we have installed it on macOS Tahoe 26.1.

Reply

Answer 5

Nov 19, 2025 8:47 PM in response to acky_larkham

acky_larkham wrote:

Thank you for replying. I require a VPN to connect to my workplace network. I have already contacted the network administrator. However, the cause and solution have not been identified. This configuration profile is proven to work, but this is the first time we have installed it on macOS Tahoe 26.1.

My guess is that something in the configuration profile is specific to your previous OS and the IT staff will have to modify the profile to allow your current system to install and connect.

Reply

Answer 6

acky_larkham Author

Level 1

24 points

Nov 19, 2025 9:07 PM in response to BobTheFisherman

I cannot find any configuration profiles in Apple Configurator that depend on the macOS version. Also when I recreate the configuration profile using Apple Configurator on macOS Tahoe 26.1 and install, the same error occurs.

Reply

Answer 7

lkrupp

Level 7

22,105 points

Nov 25, 2025 3:28 PM in response to acky_larkham

acky_larkham wrote:

Thank you for replying. I require a VPN to connect to my workplace network. I have already contacted the network administrator. However, the cause and solution have not been identified. This configuration profile is proven to work, but this is the first time we have installed it on macOS Tahoe 26.1.

You should have contacted your IT department before updating. Qualified IT personnel set up test machines to test every update before allowing updates. When i was working for a large telecomm company it would take weeks before a new version of Windows was released for employees after thorough testing. If you job depends on it never update without testing first. Now you will have to wait an unknown amount of time for this issue to be resolved, either by IT or IT working it out with Apple. Lesson learned.

Reply

Answer 8

acky_larkham Author

Level 1

24 points

Nov 25, 2025 11:30 PM in response to lkrupp

I resolved this issue. Upon checking the macOS logs, I found the following error:

Failed to save configuration VPNname because it is invalid: Error Domain=NEConfigurationErrorDomain Code=2 “configuration is invalid: Invalid DH group (2), valid values are 14-21, 31, and 32” Invalid DH group (2), valid values are 14-21, 31, and 32" UserInfo={NSLocalizedDescription=configuration is invalid: Invalid DH group (2), valid values are 14-21, 31, and 32Invalid DH group (2), valid values are 14-21, 31, and 32}Upon checking the profile, the Diffie-Hellman Group (DH group) value was set to 2.

Upon checking the configuration profile, the Diffie-Hellman Group (DH group) value was set to "2". I inquired with the network administrator about valid DH group values, updated the DH group value in the configuration profile, reinstalled it, and succeeded.

The DH group value is set in two locations: “IKESecurityAssociationParameters” and “ChildSecurityAssociationParameters”, so both must be updated.

Reply