OpenVPN supports certificate based auth but key-based SSH auth is considerably easier to do (and depending on your experience may be easier to manage). You can

OpenVPN supports certificate based auth but key-based SSH auth is considerably easier to do (and depending on your experience may be easier to manage). You can also restrict the commands that can be run so you can use things like Git or tunnel MySQL loopback connections without handing over the box.