Some security changes/hints.

build_key-pass.sh

@@ -462,13 +462,17 @@ cat << EOF >> "$_client_conf_file"  2> $log_file
 #
 # To use this feature, you will need to generate
 # your server certificates with the nsCertType
-# field set to "server".  The build-key-serve
+# field set to "server".  The build-key-server
+# script in the easy-rsa folder will do this.
 #
 # Note!
-# This option has been deprecated since version 2.4 and 
-# will be removed from later distributions.
+# The option "ns-cert-type" has been deprecated since 
+# version 2.4 and will be removed from later distributions.
 #
+# Use the modern equivalent "remote-cert-tls"
+# 
 ;ns-cert-type server
+remote-cert-tls server
 
 # If a tls-auth key is used on the server
 # then every client must also have the key.
@@ -508,7 +512,7 @@ EOF
 
 if [[ -n "$SERVER_CIPHER" ]]; then
    cat <<EOF >> "$_client_conf_file" 2>> "$log_file"
-cipher AES-256-CBC
+cipher $SERVER_CIPHER
 EOF
 fi