Because key based authentication is a lot more secure than username/password based authentication because it's nearly impossible to bruteforce. By bruteforce I mean, try all possibilities untill you find the correct one which let's you login. Generally the harder it is to find the right username/password combination, the more secure your system is.
For example:
You use a username like: aH#398x*t$
And you use a password like: %ygo74Xg2&
So both are 10 characters, completely random. You use lower case, upper case, numbers and special characters, so for every character there are 95 possibilities (ASCII). This would make the complexity to bruteforce the username 95^10, to bruteforce both the username and password the complexity would be 95^20. So 95^20 = 3.58*10^39.
If you use standard key based authentication with 2048 bit RSA keys (2^2048 roughly equals 10^616) then this means if you have to bruteforce it, you will have to try all possible RSA keys. This effectively means trying all prime numbers of size 1024 bit. You can roughly estimate how many prime numbers there are with the following formula: n / ln(n)
2^1024 / ln (2^1024) roughly equals 10^310.
So if an attacker wants to attack your system he would need to bruteforce either 10^39 or 10^310 possibilities. Say an attacker is capable of an offline attack, then quite an average videocard is already capable of trying 10 billion possibilities per second. Quite often it is possible to find out what the username is, so he would only need to bruteforce 10^19 passwords.
10^19 / 10^10 = 10^9 seconds = 31 years with an average desktop computer.
So it is feasible for an attacker to crack this in a short amount of time if he has enough computers available.
But 10^310 is nearly impossible to bruteforce because the number is so huge. To get the same security you would need a random password that is about 156 characters long. (10^310 = 95^x)
So this is why almost always keys are adviced for vpn / ssh. It's on a completely different level of security than passwords.
EasyRSA is a tool included with openvpn to make the generation of RSA keys easier for you. But RSA keys generated with OpenSSL or other crypto tools will work perfectly fine with openvpn too.
This stackoverflow answer explains the amount of prime numbers in RSA keys some more:
https://stackoverflow.com/questions/16091581/how-many-prime-numbers-are-there-available-for-rsa-encryption
A more mathematically accurate side note: 10^310 is merely the number of primes in that key space. There are more efficient algorithms than merely bruteforce trying all prime numbers. The currently fastest known method of factoring is GNFS.
exp(((64/9)^(1/3))(log(2^2048))^(1/3)(log(log(2^2048))^(2/3)))
512: 63.9 bit
1024: 86.7 bit
2048: 116.8 bit
4096: 156.5 bit
8192: 208.4 bit
16384: 276.5 bit
So for a 2048 bit prime number, instead of having a 1029 bit (2^1029 = 10^310) complexity, you'd only have to attack 116.8 bits.
10^116.8 = 95^x -> x= 59
So a 59 character random password would have equivalent security to a 2048 bit RSA key with current factorization methods.
tls-authgenerated withopenvpn --genkey --secret ta.key. However, I don't have any entries for--authand--cipher, would you consider this a big security risk?