Here is how I did it, if you have problems or questions with this guide,
please ask, so I can improve comments, hints
http://tryapi.wordpress.com/
http://www.raspberrypi.org/phpBB3/viewtopic.php?f=36&t=21566
points to note
1) It is implied that you to set up router static DHCP to the PI, and know how to setup port-forwarding
on the router, I used port 80 udp, but you can use whatever you like. the default is usually port 1194 udp
that the PI will have a fixed NAT address e.g. 192.168.1.6 and port 80 UDP is port forwarded to 192.168.1.6
2) I had to use a dynamic DNS host to access the PI, hence the bit about no-ip
3) I changed the ca.crt name to capi.crt because I have more than one VPN
