Upgraded to stretch, and again openvpn was tricky - this time, it complained about not having rights to its temp dir, because access() behaves strangely when capabilities are restricted, even though in practice it would have had rights. chmod with more permissive rights to the rescue…