The antennas are a physics thing, not a manufacturer thing. I would try a router that has bigger antennas, like for example the RB4011iGS+5HacQ2HnD-IN. That would improve very much the signal strength. so Mikrotik solution is to buy 5 times more expensive router? nice one.... if i knew it that hap ...
Not using OpenVPN on MT, nor v2.3 but the error seems to be triggered by the ExtendedKeyUsage extension.
If i got it right then OpenVPN2.4 is doing some checks on the certificate and yours is not generated the right way.
Good hardware but poor overall package (software and hardware).
Now the logical question - was Mikrotik aware?
Are there AC2 with correct placement of the heatsink?
Will Mikrotik partners be replacing units with the mentioned "design" or the users will be forced to fix the problem by themselves.