I seem to recall there was a specific reason we allowed the password to be empty. There was an auth use case which required it at some point, but I can't find notes about it anywhere now. I do see 7304c02 (https://redmine.pfsense.org/issues/3633) but that case is blank user but filled in password.

That same issue with being blocked waiting for auth can happen if the username is blank as well as the password, if the server requires user auth, so it's not something we can always prevent. We do add auth-retry nointeract which is supposed to prevent this. But the user can override that by checking "Do not retry connection when authentication fails".

This happened to me when I copied a OpenVPN client and only changed the host address. The resulting copy doesn't include the password, even though it indicates it during copy. I didn't realise this and status said the the daemon couldn't be contacted, so I though a reboot would help. Then the router was stuck at startup like in the description here.
I had to buy a soldering iron to fix my null-modem cable, so it took me many hours to find the issue.
But I guess this PR will not fix that copy issue.

I read https://redmine.pfsense.org/issues/3633 and, yeah, in some rare cases the password may be empty,
but I think we need to add a note about possible boot problems

This happened to me when I copied a OpenVPN client and only changed the host address. The resulting copy doesn't include the password, even though it indicates it during copy. I didn't realise this and status said the the daemon couldn't be contacted, so I though a reboot would help. Then the router was stuck at startup like in the description here.

This is other issue and I can can confirm that if you copy/close OpenVPN settings auth_pass is lost, even though it shows asterisks in the password fields
I'll create new redmine issue

The password issue is probably because of the Confirm box on the page, which really isn't necessary. That form only needs the password itself, no need to confirm it since it's not being set like a password, but for later (re)use.

@vktg please rebase your fork and fix conflicts

Fixed and updated