+ cat <<'EOF'
+usage: ${0##*/} VPN_SERVER_HOST
+
+-b COMMON_NAME By default, use $CLIENT_HOST or if it is not given,
+ $HOSTNAME. If the cert already exists on the server,
+ with the CLIENT_NAME name, we use the existing one. See
+ comment below if we ever want to check existing common
+ names. They must be unique per server, so you can use
+ $(uuidgen) if needed. You used to be able to create
+ multiple with the same name, but not connect at the
+ same time, but now, the generator keeps track, so you
+ can't generate.
+
+-c CLIENT_HOST Default is localhost. Else we ssh to root@CLIENT_HOST.
+-n CONFIG_NAME default is client
+-s SCRIPT_PATH Use custom up/down script at SCRIPT_PATH. copied to same path
+ on client, if client is not localhost.