Static certificates leave private subnets vulnerable when client devices go missing. Here is how we deployed OpenVPN on Ubuntu with Easy-RSA and Google Authenticator 2FA across 45 remote engineers.