I played around with uploaded certificates but ran into some errors. Possibly related to using *.p12 files that required passwords without supplying a password, or maybe they did not require a password. Using /usr/share/doc/openvpn/examples/sample-keys/pkcs12.p12 as a test case. At any rate, I got NPEs from StandardCertificateCredentials$NameProvider.getSubjectDN which ought not happen.