# Open SSTP Client, an Android VPN client for the SoftEther and VPN Azure protocol > Open SSTP Client is a Kotlin Android application that implements the Secure Socket Tunneling Protocol so a phone can connect to a SoftEther VPN Server or VPN Azure Cloud, with a tunnelled PPP layer, custom DNS and per-app routing rules. It suits users of that specific server stack, and its own documentation is blunt about the limits, from restricted authentication protocols to the fact that only some environments have been tested. **kittoku/Open-SSTP-Client** — Open SSTP Client for Android - Repository: https://github.com/kittoku/Open-SSTP-Client - Stars: 554 · Forks: 141 - Language: Kotlin - License: MIT - Published: 2026-10-22 · Updated: 2026-10-22 · Language: en - Canonical page: https://hysenlabs.com/projects/kittoku-open-sstp-client ## One protocol, one server stack, and a stated testing gap Open SSTP Client is an open-sourced Secure Socket Tunneling Protocol client for Android, written in Kotlin, developed for accessing VPN Azure Cloud or a SoftEther VPN Server. The scope is narrow and the project is candid about it. The README says that no test with other servers is done, and that its behavior may still be unstable. That is a specific and useful caveat: the client is written against one server implementation and its compatibility with other SSTP servers is untested rather than claimed to work. The protocol itself is the reason the client exists. The Secure Socket Tunneling Protocol is Microsoft's extension for carrying PPP traffic over an HTTPS connection, which is what lets a SoftEther or VPN Azure server act as a VPN endpoint without the client needing a native tunnel driver for that server family. The repository layout matches a normal Android application, with an app/ directory, build.gradle, settings.gradle, gradle.properties, the gradlew wrapper scripts, a gradle/ directory, and images/ for the screenshots used in the readme. There is also a CONTRIBUTING.md, a CONTRIBUTORS.md, a CODE_OF_CONDUCT-style set of community files in the form of PRIVACY_POLICY.md, and a LICENSE. The distribution is ordinary for an Android app. The latest version is on Google Play under the package id kittoku.osc, and previous versions are released as apk files on the releases page, which is the usual arrangement when an app also needs to serve people without Play services. ## Turning the switch on, and the key icon that tells you it worked The usage section is short because the app has few controls, and the interesting part is how you know the tunnel is up. You enter the Host, Username and Password preferences and turn the switch on. If a key icon appears on the right side of the status bar, establishing a VPN connection has succeeded. To disconnect, you turn the switch off in the home tab or tap the notification. Profiles can be saved and loaded from the upper-right option menu, which is a small but important detail for anyone with more than one server or more than one set of credentials. The Notice section then lists the constraints that will otherwise cost you an afternoon. The Host preference can contain an IP address but cannot include a port number, and the port is configured in the setting tab. Your device needs to install a self-signed certificate and disable the Verify Hostname option to access a server using one. A server must enable DHCP. And only PAP and MS-CHAPv2 authentication protocols can be enabled, with no EAP. That last point deserves emphasis for anyone coming from a corporate VPN. EAP support is not a gap that a configuration change will close; it is simply not implemented, so a server that requires EAP cannot be used with this client at all. ## The setting tab: trusted certificates, PPP protocol and custom DNS Three settings carry the technical detail, and each has a reason behind it. Add Trusted Certificates, which in version 1.7.0 or older was displayed as Specify Trusted Certificates, lets you choose a directory. If you do, the client uses only the certificates in that directory while still using the default certificate store, and the README says the option was made for debugging. That is a narrow, deliberate escape hatch for a server with an unusual certificate, not a general trust management screen. The PPP Network Protocol setting chooses what network protocol the PPP layer tries to enable. The README warns that the IPv6 option just gives the device a link local address and never guarantees that you can communicate perfectly with IPv6. That is a carefully worded warning about a feature that looks like it does more than it does. Custom DNS Server Address lets you specify which DNS server to use. Packets associated with that address are routed to the VPN tunnel, and the README notes that if you specify an IPv4 or IPv6 address and disable that network, domain names possibly cannot be resolved. The Enable App-Based Rule option, with its Select Allowed/Disallowed Apps control, specifies which apps can or cannot use the VPN tunnel. There is a condition attached: even allowed apps cannot use the tunnel if their routes are not on the routing table, which is why the README recommends enabling the Add Default Route option when you use this. ## Debugging your own connection, with a cipher suite choice for that purpose The Debugging section is the most unusual part of the documentation, and it explains a lot about the project's shape. The author writes that it is almost impossible to debug a problem caused in any environment but their own, and that in a networking app there are many possible reasons to cause a problem which cannot be identified unless the problem can be reproduced in their environment. The instruction is therefore to debug by yourself. The tool offered for that is the Select Cipher Suites option. With it, the client tries to use TLS_RSA_WITH_AES_128_CBC_SHA or TLS_RSA_WITH_AES_256_CBC_SHA as a cipher suite, so that packets can be decrypted and investigated with software like WireShark. The author adds that there could be a similar app for Android, and reminds the reader of Android Studio and its emulator. The choice of legacy RSA cipher suites is the point. These suites are not what a current client would negotiate, and enabling them is a deliberate weakening of the transport in exchange for visibility. That is a debugging tool, not a deployment setting, and it is worth knowing which cipher suite your traffic is actually using before you conclude that a connection problem is on the server side. The section also notes the author does not have Windows Server OS, so accessing it is not officially supported, though there is a successful case referenced in an issue thread. ## Licence, risk and what the project does not promise The licence section is one line: licensed under MIT, with a reminder to use the software at your own risk. The MIT terms are permissive, with no copyleft obligation on an application that merely uses the app, though the app is distributed through Google Play as a binary rather than linked into your product, so the usual library licensing questions do not arise here. The risk wording is not boilerplate in this case. The README has already said the behaviour may be unstable, that no test with other servers is done, that only PAP and MS-CHAPv2 are supported, and that reaching a server with a self-signed certificate requires installing that certificate on the device and disabling Verify Hostname. Disabling hostname verification is a real reduction in security, and it is a requirement here rather than an option. What the project does not promise is as important as what it does. There is no EAP, no support for other SSTP servers, no official Windows Server support, and a stated impossibility of debugging anything the author cannot reproduce locally. The app also expects the server side to enable DHCP, so the server has to be configured in a particular way for the client to be useful at all. Put together, the honest summary is that this is a well-scoped client for one server family, maintained with visible recent activity, where the documentation spends more space on what will not work than on what will. ## Conclusion Adopt Open SSTP Client if you need an Android device to reach a SoftEther VPN Server or VPN Azure Cloud and the built-in Android client does not cover your setup, since this one implements the Secure Socket Tunneling Protocol with a tunnelled PPP layer and per-app rules. Do not adopt it as a general purpose VPN client, because it speaks one protocol family and supports only PAP and MS-CHAPv2 authentication with no EAP. Before you rely on it, check that your server enables DHCP and can present a certificate your device trusts, because the documentation requires installing a self-signed certificate and disabling Verify Hostname to reach such a server, and note the maintenance picture, with v1.10.2 published on 2026-05-02 and the last push on 2026-08-14. ## FAQ ### What servers can Open SSTP Client connect to? It is a Secure Socket Tunneling Protocol client developed for accessing VPN Azure Cloud or a SoftEther VPN Server. The README states that no test with other servers is done and that its behaviour may still be unstable. ### How do I install Open SSTP Client on Android? The latest version is downloaded and installed via Google Play under the package id kittoku.osc, and previous versions are released as apk files on the repository's releases page. The repository itself is a standard Gradle project with the gradlew wrapper. ### How do I know the VPN connection was established in Open SSTP Client? You enter the Host, Username and Password preferences and turn the switch on. If a key icon appears on the right side of the status bar, establishing the connection has succeeded, and you disconnect by turning the switch off in the home tab or tapping the notification. ### Which authentication protocols does Open SSTP Client support? Only PAP and MS-CHAPv2 can be enabled, with no EAP. A server requiring EAP therefore cannot be used with this client, and the client also requires the server to enable DHCP and the device to trust the server certificate, with Verify Hostname disabled for a self-signed one. ### What is the Select Cipher Suites option for in Open SSTP Client? It makes the client try TLS_RSA_WITH_AES_128_CBC_SHA or TLS_RSA_WITH_AES_256_CBC_SHA so that packets can be decrypted and investigated with software like WireShark. The README presents it as a debugging aid, and the author asks users to debug problems themselves since they can only reproduce issues in their own environment. ## Sources - [Issues](https://github.com/kittoku/Open-SSTP-Client/issues) - [kittoku/Open-SSTP-Client on GitHub](https://github.com/kittoku/Open-SSTP-Client) - [License: MIT](https://github.com/kittoku/Open-SSTP-Client/blob/main/LICENSE) - [README](https://github.com/kittoku/Open-SSTP-Client/blob/main/README.md) - [Releases](https://github.com/kittoku/Open-SSTP-Client/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/kittoku-open-sstp-client