Если у Вас нет необходимости создавать свой центр сертификации, и вы будете генерировать ключи только для OpenVPN, можно воспользоваться набором скриптов Easy RSA, который поставляются в комплекте с OpenVPN. Они находятся в директории с документацией: /usr/share/doc/openvpn-версия/easy-rsa.

В первую очередь следует перейти в эту директорию.

 # cd /usr/share/doc/openvpn-2.0.5/easy-rsa

Теперь отредактируйте файл vars.

 export D=`pwd`
 export KEY_CONFIG=$D/openssl.cnf
 export KEY_DIR=/etc/openvpn/keys
 echo NOTE: when you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
 export KEY_SIZE=1024
 export KEY_COUNTRY=RU
 export KEY_PROVINCE=RU
 export KEY_CITY=MOSCOW
 export KEY_ORG="MYORG"
 export KEY_EMAIL="it@myorg.ru"

Этот файл предназначен для установок переменных среды окружения, перед генерацией ключей. Запускаем его при помощи точки:

 # . ./vars
 NOTE: when you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/keys
 #

Теперь запускаем программу очистки (на всякий пожарный, т.е. очистит весь каталог с ключами).

 # ./clean-all
 #

Осталось запустить процесс генерации ключей и сертификата СА.

 # ./build-ca
 Generating a 1024 bit RSA private key
 ..................++++++
 ......................................................++++++
 writing new private key to 'ca.key'
 -----
 You are about to be asked to enter information that will be incorporated
 into your certificate request.
 What you are about to enter is what is called a Distinguished Name or a DN.
 There are quite a few fields but you can leave some blank
 For some fields there will be a default value,
 If you enter '.', the field will be left blank.
 -----
 Country Name (2 letter code) [RU]:
 State or Province Name (full name) [RU]:
 Locality Name (eg, city) [MOSCOW]:
 Organization Name (eg, company) [MYORG]:
 Organizational Unit Name (eg, section) []:myorg
 Common Name (eg, your name or your server's hostname) []:vpnsrv.myorg
 Email Address [it@myorg.ru]:
 #

Некоторые поля заполняются автоматически, ведь не зря мы изменяли содержимое файла vars. Хотя ответы по умолчанию можно было поместить в конфигурационный файл программы openssh ― openssl.cnf.

В директории /etc/openvpn появилась директория keys, в которой находятся файлы сертификата и ключ. Теперь следует создать ключ и сертификат для сервера.

 # ./build-key-server vpnsrv.myorg
 Generating a 1024 bit RSA private key
 ...++++++
 ..++++++
 writing new private key to 'vpnsrv.myorg.key'
 -----
 You are about to be asked to enter information that will be incorporated
 into your certificate request.
 What you are about to enter is what is called a Distinguished Name or a DN.
 There are quite a few fields but you can leave some blank
 For some fields there will be a default value,
 If you enter '.', the field will be left blank.
 -----
 Country Name (2 letter code) [RU]:
 State or Province Name (full name) [RU]:
 Locality Name (eg, city) [MOSCOW]:
 Organization Name (eg, company) [MYORG]:
 Organizational Unit Name (eg, section) []:myorg
 Common Name (eg, your name or your server's hostname) []:vpnsrv.myorg
 Email Address [it@myorg.ru]: 
 
 Please enter the following 'extra' attributes
 to be sent with your certificate request
 A challenge password []:password
 An optional company name []:
 Using configuration from /usr/share/doc/openvpn-2.0.5/easy-rsa/openssl.cnf
 Check that the request matches the signature
 Signature ok
 The Subject's Distinguished Name is as follows 
 
 countryName           :PRINTABLE:'RU'
 stateOrProvinceName   :PRINTABLE:'RU'
 localityName          :PRINTABLE:'MOSCOW'
 organizationName      :PRINTABLE:'MYORG'
 organizationalUnitName:PRINTABLE:'myorg'
 commonName            :PRINTABLE:'vpnsrv.myorg'
 emailAddress          :IA5STRING:'it@myorg.ru'
 Certificate is to be certified until Dec 11 14:31:19 2015 GMT (3650 days)
 Sign the certificate? [y/n]:y
 
 1 out of 1 certificate requests certified, commit? [y/n]y
 Write out database with 1 new entries
 Data Base Updated
 #

Сгенерируем сертификаты и ключи для клиентской машины. (для каждой новой машины лучше генерировать сертификат по ее имени)

 # ./build-key mashina_01
 Generating a 1024 bit RSA private key
 .......++++++
 .............................................++++++
 writing new private key to 'mashina_01.key'
 -----
 You are about to be asked to enter information that will be incorporated
 into your certificate request.
 What you are about to enter is what is called a Distinguished Name or a DN.
 There are quite a few fields but you can leave some blank
 For some fields there will be a default value,
 If you enter '.', the field will be left blank.
 -----
 Country Name (2 letter code) [RU]:
 State or Province Name (full name) [RU]:
 Locality Name (eg, city) [MOSCOW]:
 Organization Name (eg, company) [MYORG]:
 Organizational Unit Name (eg, section) []: myorg
 Common Name (eg, your name or your server's hostname) []:mashina_01
 Email Address [it@myorg.ru]:user@yandex.ru 
 
 Please enter the following 'extra' attributes
 to be sent with your certificate request
 A challenge password []:password
 An optional company name []:
 Using configuration from /usr/share/doc/openvpn-2.0.5/easy-rsa/openssl.cnf
 DEBUG[load_index]: unique_subject = "yes"
 Check that the request matches the signature
 Signature ok
 The Subject's Distinguished Name is as follows
 countryName           :PRINTABLE:'RU'
 stateOrProvinceName   :PRINTABLE:'RU'
 localityName          :PRINTABLE:'MOSCOW'
 organizationName      :PRINTABLE:'MYORG'
 commonName            :PRINTABLE:'mashina_01'
 emailAddress          :IA5STRING:'user@yandex.ru'
 Certificate is to be certified until Dec 11 14:39:59 2015 GMT (3650 days)
 Sign the certificate? [y/n]:y 
 
 1 out of 1 certificate requests certified, commit? [y/n]y
 Write out database with 1 new entries
 Data Base Updated
 #

В заключении следует создать Diffie Hellman параметры.

 # ./build-dh
 Generating DH parameters, 1024 bit long safe prime, generator 2
 This is going to take a long time
 ..+.......................................................................+...+
 .....+.....+...................................................................
 ............................+..................+.+...........+.................
 ...+.....++*++*++*
 #

И создать секретный ключ.

 # openvpn --genkey --secret /etc/openvpn/keys/ta.key

Посмотрим содержимое директории /etc/openvpn/keys:

 
 # ls /etc/openvpn/keys/
 01.pem                ca.key               index.txt.old
 02.pem                dh1024.pem           serial      
 03.pem                mashina_01.crt       serial.old
 vpnsrv.myorg.crt      mashina_01.csr       ta.key 
 vpnsrv.myorg.csr      mashina_01.key       
 vpnsrv.myorg.key      index.txt            
 ca.crt                index.txt.attr
                       index.txt.attr.old
 #