Install needed packages:

# apt install --no-install-recommends openvpn openssl

Download easy-rsa v3.0.4 and install it.

# wget --no-check-certificate https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.4/EasyRSA-3.0.4.tgz
# tar -xvzf EasyRSA-3.0.4.tgz
# rm EasyRSA-3.0.4.tgz
# mv EasyRSA-3.0.4/ /etc/openvpn/easy-rsa/

Initialize a new PKI and generate a CA keypair that will be used to sign certificates.

# cd /etc/openvpn/easy-rsa
# export EASYRSA=$(pwd)
# easyrsa init-pki
# easyrsa build-ca