Certificates are for authentication, not for authorization.
Authentication is (here) about the OpenVPN server making sure that the alleged client is who they claim to be. This is the point of certificates: the client shows his certificate, which contains his public key and identity; the server validates the certificate (with regards to its trusted CA) to make sure that the certificate contents are genuine; the client demonstrates mastery of the corresponding private key (normally by generating a signature based on a challenge from the server -- this is done within the particulars of the communication protocol). That way, the server learns that whoever is at the other end of the line really is the owner of the public key which is in the client certificate; and the certificate, being verified to be genuine, allows the server to infer that the identity in the certificate really is that of the key owner.
Authorization occurs as a second step. Now that the server knows who is calling, it must still decide whether that client shall be granted access or not. This is a server-side decision.
From your description, you (apparently) configured OpenVPN to use certificates for authorization; or, said otherwise, you apply "automatic authorization" which grants access to anybody who could get authenticated. This is the root of your problem; certificates are not good for authorization. As you noticed, if you use such an authorization rule, then the "allowed users" cannot be reliably listed, unless you keep knowledge of all issued certificates. Also, if you want to close the access for a user, then you normally need to close it now, not within one week; but revocation is asynchronous and will be really effective only when the previous CRL has expired.
While a good CA must retain precise knowledge of all the certificates it has issued (if only to be able to revoke a certificate at will), there is no mechanism in X.509 to ensure the consistency and integrity of such a list. Moreover, the asynchronous nature of revocation is further proof that certificates provide inadequate means of authorization.
What you really need is to maintain an exhaustive list of "allowed users" on the server side (in the OpenVPN configuration files). The users would be identified by their name (apparently, OpenVPN uses the 'Common Name' part of the subjectDN in certificates to reference users); the server will extract the client identity from the incoming client certificates and authorize the user only if it appears in the list of allowed users. If you deploy such explicit authorization, then you have your reliable list of allowed user since, by definition, it is the list that the OpenVPN server uses to grant or deny access. Moreover, it allows you to block and unblock access for any specific user instantly.