http://netbsd.i2p/docs/network/ipsec/rasvpn.html
You will get a x509 certificate, that we shall
name vpngw.crt If you want to be your own CA, then perform the following steps
to generate the CA private key and certificate, and to sign your
CSR: # cd /etc/openssl
# mkdir -p demoCA/newcerts
# touch demoCA/index.txt
# echo "00" > demoCA/serial
# umask 077
# openssl genrsa > certs/ca.key
# umask 022
# openssl req -days 3650 -x509 -key certs/ca.key -new > certs/ca.crt
# openssl ca -in certs/vpngw.csr...