Interesting. If true, this seems to contradict the statement released here: http://docs.openvpn.net/important-security-notice-regarding-...
Have you contacted OpenVPN directly?
Have you contacted OpenVPN directly?
There is a bit more info in the "community" wiki [0]. It seems the key point is that TLS-auth would already mitigate the vulnerability. TLS-auth is on by default in OpenVPN Access Server, but for the vanilla openvpn, you have to configure it yourself.
And, as noted in the community statement, the TLS-auth is a single global pre-shared key. It could leak a bit more easily than personal certificates.
Thus, if you have used it in your OpenVPN setup, and if you know that the few users who have access to your VPN wouldn't have heartbleed-attacked you, then yes, you could assume that your private key has been safe from heartbleed despite an exploitable OpenSSL library.