Personally, I tend to use the easy-rsa set of scripts https://github.com/OpenVPN/easy-rsa https://github.com/OpenVPN/easy-rsa. Initially they used to come as a

Personally, I tend to use the easy-rsa set of scripts https://github.com/OpenVPN/easy-rsa https://github.com/OpenVPN/easy-rsa. Initially they used to come as a goodies with OpenVPN, but they are now provided as a standalone project. There are already packaged and available in most distributions (easy-rsa package under Debian for example). There are probably a little bit more complex to use, but it's far from horrible, and it's quite battle tested.