How do I set up OpenVPN on CyanogenMod 7? I want to route all my network traffic through my home's ISP connection when I'm out in Internet cafes so I can't be eavesdropped/firesheeped.

I have an HTC G2 with CyanogenMod 7, which has OpenVPN client support built-in:



At home, I have a router with TomatoVPN on it, which includes an OpenVPN server:



Now, how do I get the phone client to connect to the router server?  I can Google and find a set of seemingly relevant instructions, but they aren't very helpful:


  You need to pack your cert and keys and put it in SD card


Where do I get those?


  Copy client.p12 to sdcard root directory


Where do I get that?


  add your certificates, and set the interface type and the protocol accordingly. 


How, specifically?  Which settings should be what?  Using settings that don't protect me is worse than no protection at all due to the false sense of security.

I'm looking for step-by-step instructions for a "roadwarrior" setup that routes all traffic through the VPN.

Where do I get keys?  Do I need to use additional username/password authentication? What DNS search domains? What settings should I use in CM7's OpenVPN Advanced menu?  "Redirect gateway" needs to be set to route all traffic, for instance, right?  Which settings for Basic and Advanced in TomatoVPN?  "Direct clients to redirect Internet traffic"? "Respond to DNS"? 

Update:

I've given it yet another try on my own, and was again unsuccessful.  I don't think there's any way to generate keys on either the router or the phone, so I tried to generate them in Ubuntu.  I tried to follow these directions to generate keys, but they aren't correct.  (The folder is /usr/share/doc/openvpn/examples/easy-rsa/2.0 instead of /usr/share/doc/openvpn-2.0/easy-rsa, for instance, and there's a vars, but no init-config script.)  I found these directions, which are more helpful, and generated a number of files:


01.pem
02.pem
ca.crt  
ca.key
dh1024.pem  
htc_g2.crt  
htc_g2.csr 
htc_g2.key  
server.crt  
server.csr 
server.key
ta.key


The files I copied to the router are 


ca.crt
server.crt
server.key
dh1024.pem


first stripping everything before -----BEGIN, according to these instructions.  The router server starts now and says 


  Name  Value
  Max bcast/mcast queue length  0


under Status.  So I guess the server is working?

Then I copied these files to the phone:


ca.crt
htc_g2.crt
htc_g2.key
server.crt
ta.key


Different directions disagree on which files to copy.  Then I went to Settings → Location &amp; security → Install from SD card, and was able to install the CA certificate, added a password, etc.  Trying to add the htc_g2 or server certificates did not work, saying "no certificate to install".  I edited the files and removed everything before -----BEGIN, and then they installed.  In "Add OpenVPN VPN", I selected the "ca" certificate for "Set CA certificate", and the htc_g2 certificate for "Set user certificate".  When I try to connect, it says "Unable to connect to network".  Same if I try the server certificate for the user certificate.
First of all, check the Keys tab in TomatoVPN to see if you already have some default keys defined. If not, check out the OpenVPN HOWTO for info on how to generate the keys. Next, copy the first two keys (CA and Server certificate) from the text areas to a text editor and save them with .cer suffix and transfer them to your phone. CM7 should be able to import .cer certificates directly but older versions may need to use .p12 files (see this link for info on how to convert .crt -&gt; .pem -&gt;.p12). After this, go to Settings -&gt; Security -&gt; Install from SD Card to load the certificates to the phone.