thanks, esp. for the more in-depth discussion why it can be useful to authenticate via TLS client certificate and user+pass: two-factor authentication with an OTP (see e.g. https://github.com/evgeny-gridasov/openvpn-otp) -- I suspect getting our OpenVPN implementation into shape with OTP will require some more effort (and needs someone with a setup that requires it ;)