Cert verification when remote-cert-tls server is set

ExplodingLemur

I've set up my own CA, used it to sign the OpenVPN server and client certs, but when I try to connect with "remote-cert-tls server" set, the clients fail to verify the server certificate (both Ubuntu and iOS).
Ubuntu message:
TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
iOS message:
VERIFY FAIL -- bad X509 key usage in leaf certificate
VERIFY FAIL -- bad X509 extended key usage in leaf certificate
My CA cert is configured with the CA:TRUE basic constraint, and key usage set for certificate and CRL signing. My server cert is set with the Netscape cert type extension set to SSL Server. What am I missing? (semi-redacted) certificate data is in the following Pastebin pastes: http://pastebin.com/r7sShcxm
Any thoughts as to what I'm missing? Thanks! (OpenVPN 2.3.2 on Ubuntu 14.04)

Traffic

did you use easy-rsa to make your PKI ?

ExplodingLemur

No, openssl alone on the command line. I was apparently missing the extendedKeyUsage=serverAuth attribute that easy-rsa sets, added that to the appropriate section of my own openssl.cnf and re-generated that cert and it works now.
Full functioning [server] section of my openssl.cnf:
basicConstraints=CA:FALSE
nsCertType = server
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer:always
extendedKeyUsage=serverAuth
keyUsage = digitalSignature, keyEncipherment