There is a file, client.csr, generated by easy-rsa with the build-key command that is not referred to in the howto. What is this file for and what do I do with it?
This is a “certificate signing request.” Easy-RSA self-signs your certificates with a local Certificate Authority (CA), so in typical cases you don’t need this file. However, if you use an external CA, you can take the .csr and hand it to the CA, and they will hand you back the signed .crt certificate. This can usually be done over a cleartext channel, but care must be taken to ensure that the CSR does not change en route. You may confirm fingerprints by calling the CA’s administrator or contacting them directly somehow.
