Abstract:OpenVPN is widely used in the real network, the assessment of its security has important practical significance. In this study, technology of state fuzzing is used to carry out black box test on OpenVPN implementation to infer state machine of the target system automatically based on model learning method in automata theory. Time compression model is proposed and state machine of OpenVPN is simplified to remove the redundant states and transitions. Then, the behavior characteristics of the protocol state machine will be obtained accurately to discover a number of special behavior paths and potential security risks outside the expected behavior path. It provides a new idea for the security evaluation of OpenVPN and has important significance for obtaining the internal design details of similar security protocols with little specification but widely used.