https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/client-authentication.html#mutual
I followed the documentation, even chasing down an older version of OpenVPN/easy-RSA. All were created and uploaded to the AWS cert-manager. The server and client certs show in the Cert Manager interface but when trying to create the Client VPN endpoint the Server certificate ARN does not show in the interface. A search reveals no ARN.
I then backed off and followed the client VPN tutorial video. Downloaded the EasyRSA-3.0.7-win64, followed the instructions but I believe there are some gaps between producing the certs (no configuration of the certs) and the coping for the production directory to the director he uploaded to the directory.
I'm sincerely at a loss.
