You don't generate a key pair to share with the client? How does that even work when you want to disable a key or set a password?

What i meant generating keys is not equal to generating certificate in the common sense of this word, it only works with randomly generated keys , passwords are not save way to encrypt data unless you can remember random sequence of characters for every client you have. If look at WireGuard protocol will get all the answares.

I got my answers, it is pretty much openvpn with a different wireprotocol and there are key pairs.