I'm looking to use FreeIPA's PKI for OpenVPN... any pointers on the right
way to generate per-user certificates? (Looking to generate certs for
Android and Chrome OS, so I don't have an easy way to build a CSR on those
devices directly that I can find; I assume I want to just generate the cert
& key on the IPA server, copy it securely, then nuke the private key, and
place the public key somewhere for OpenVPN to find?