I don’t work with certificates in RouterOS much, I mostly import existing ones created elsewhere (that’s my preventive excuse 
). But it seems to work fine.
On first router, I create new certificates like this (based on manual):
/certificate
add name=ca-template common-name=myCa key-usage=key-cert-sign,crl-sign
add name=server-template common-name=server.example.net
add name=client1-template common-name=client1
sign ca-template name=myCa
sign server-template ca=myCa name=server
sign client1-template ca=myCa name=client1
set server trusted=yes
Then I export required certificates for client (they go in config file):
/certificate
export-certificate myCa
export-certificate client1 export-passphrase=xxxxxxxx
I configure OpenVPN on router with “server” certificate, and client can connect.
To move certificates to another router, I first export them:
/certificate
export-certificate myCa export-passphrase=xxxxxxxx
export-certificate server export-passphrase=xxxxxxxx
Then on second router:
/certificate
import file-name=cert_export_myCa.crt passphrase="xxxxxxxx"
import file-name=cert_export_myCa.key passphrase="xxxxxxxx"
import file-name=cert_export_server.crt passphrase="xxxxxxxx"
import file-name=cert_export_server.key passphrase="xxxxxxxx"
After setting certificate for OpenVPN server and changing server.example.net to point to new router, client can connect again, without any changes required.
Interestingly, I have no “I” flag at all (this is from original router):
/certificate print
Flags: K - private-key, L - crl, C - smart-card-key, A - authority, I - issued, R - revoked, E - expired, T - trusted
# NAME COMMON-NAME SUBJECT-ALT-NAME
0 K A T myCa myCa
1 K A T server server.example.net
2 K A client1 client1