* Empty CRLs don't work. * Avoids confusing easyrsa during the init step where it thinks an existing PKI configuration exists. * Add to ovpn_run to help users that are upgrading and ran genconfig which now depends on the file being present. * Use a hardlink to tip toe around permissions issues.