AFAIK, the OpenVPN documentation sets you up to use a different certificate for each client. It's true that they're all signed by the same CA, but that doesn't make them all the same certificate. You should mint a new certificate for each client (otherwise revocation becomes a very unpleasant all-or-nothing proposition). Is a different certificate for each client, all signed by the same CA, not enough to do what you want?
My apologies if you already knew that OpenVPN would do this, and there are good reasons why it doesn't work for you; but your question didn't suggest that you were aware of this.