Protect your certificate authority server the way you would protect a nuclear bomb. Make sure that it is as secure as possible and that you perform full system backups frequently. You also want to protect those backups so they are not accidentally compromised.
Get step by step instructions for creating enterprise certificate authority on your customer's VPN.
Get more info on setting up your customer's VPN.