From answers to this question ive been recommended to not create client keys on the server home to ca.key but rather make the clients create their own private key and simple pass a csr to the ca server to be signed and get it back. This way private keys do not have to be distributed.
Ive googled quite a fair few terms and phrases but i havnet hit anything regarding how to do this. Ive looked at the howto on openvpn and though it discusses this option, it doesnt say how. Can anyone point me to any tutorials etc?
Id also like to know how easy this would be to do for clients, especially if they arent so hot with computers.