MacOS Sierra Launch Daemon won't start VPN service before login prompt
Your plist contains major errors and minor glitches. The proper plist - including stderr and stdout - looks like this:

&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
&lt;plist version="1.0"&gt;
&lt;dict&gt;
    &lt;key&gt;Label&lt;/key&gt;
    &lt;string&gt;com.vpn_at_boot&lt;/string&gt;
    &lt;key&gt;ProgramArguments&lt;/key&gt;
    &lt;array&gt;
        &lt;string&gt;/bin/sh&lt;/string&gt;
        &lt;string&gt;-c&lt;/string&gt;
        &lt;string&gt;/usr/local/sbin/sstpc vpn-redacted.redacted.com --user redacted --password redacted --log-stderr --cert-warn require-mschap-v2 noauth refuse-eap noccp&lt;/string&gt;
    &lt;/array&gt;
    &lt;key&gt;RunAtLoad&lt;/key&gt;
    &lt;true/&gt;
    &lt;key&gt;StandardErrorPath&lt;/key&gt;
    &lt;string&gt;/tmp/com.vpn_at_boot.err&lt;/string&gt;
    &lt;key&gt;StandardOutPath&lt;/key&gt;
    &lt;string&gt;/tmp/com.vpn_at_boot.out&lt;/string&gt;
&lt;/dict&gt;
&lt;/plist&gt;


Replace redacted with the proper domain name, user and password in your plist.

Your plist misses important tags (e.g. &lt;/dict&gt; and &lt;/plist&gt;). It contains unnecessary stuff like sudo. The sstp-client may be updated later, so use its link in /usr/local/sbin. I also recommend to add /usr/local/sbin to /etc/paths.

The plist permissions have to look like this:

-rw-r--r--  1 root  wheel  - 682 Jun  9 13:38 /Library/LaunchDaemons/com.vpn_at_boot.plist


After running the daemon successfully (i.e. without errors) you may remove the keys StandardErrorPath and StandardOutPath and their corresponding strings in the plist.