My server's easy-rsa file structure was accidentally deleted from the server during an os upgrade. I still have the ca.crt but no longer have ca.key or the client keys.
What are the ramifications for OpenVPN? Can I make new client certificates or revoke existing client certificates?
You cannot sign anything without the private key. That includes new client certificates and CRLs. If the same CA signed the OpenVPN server certificate, you won't be able to renew that when it expires.
Assuming you didn't have a backup of your system; your only option it to start again as far as certificates are concerned. You'll need to create a new CA and issue replacement certificates to all.
As you'll stop trusting your original (now defunct) CA, the current certificates will simply become invalid - no need to worry about not being able to revoke them.
