openvpn: add "extra-certs" option