easy-rsa can do 4096bit keys, been there done that, we should recommend it for VPNs