easy-rsa 3 has saner defaults, especially how it configures OpenSSL, so if you fork that would be a good place to start.