Which CA File Goes in a Password-Only OpenVPN Profile?

Work through four questions in order and the CA dialog stops being ambiguous. What material did the operator actually issue, what does the profile already contain, which field is asking, and what happens after the file loads. Stop at the first question you cannot answer from the operator's own instructions, because guessing past it is how a public CA certificate ends up paired with a private key that should never have left the server.

The order matters: the last two questions only make sense once you know which material is supposed to exist.

Start With What the Profile Already Carries

Open the profile in a text editor and look for a ca block before you look for a file. An inline ca block holding the operator's public CA means the profile is self-contained, and a client that still asks for a CA file may be reading a different profile or an incomplete import. If the profile instead has a ca line pointing at a path, that path is relative to the client's working directory on some integrations and absolute on others. Note which form you have before changing anything.

ca /absolute/path/operator-ca.crt
auth-user-pass
remote-cert-tls server

Check the delivered package for the files the profile references: a CA certificate, sometimes a separate client certificate and key, and possibly a tls-auth or tls-crypt file. A profile referencing four files that arrives with two is incomplete, and no amount of field-pointing repairs that. Ask the operator for the missing piece instead of substituting a certificate you happen to have.

Separate Four Kinds of Material

The CA certificate is public material used to verify the server's identity. A client certificate identifies the user or device to the server. A private key is the secret half of that client certificate, and it must never be the CA's signing key or a server key. tls-auth or tls-crypt material is a separate shared secret that protects the control channel. These four are not interchangeable, and pointing the CA field at a client certificate produces a verification failure that reads like a trust problem.

Password-only authentication changes which of the four you need, not what they mean. With auth-user-pass and remote-cert-tls server, the client still verifies the server against a CA, which is why the CA field appears even when no client certificate exists. The operator's policy decides whether a client certificate is also required, and no dialog can tell you that.

Point the Client at the Trust File

Select the CA certificate file itself, not the folder containing it and not a .p12 bundle that holds a client identity. On Windows the path syntax and the file picker behave differently from the Linux examples in most guides, so use what the installed client accepts and confirm the file is readable by the account running it. A permissions problem and a missing file look the same in the dialog but produce different log lines. After selecting, reopen the profile settings to confirm the client kept the choice.

<ca>
-----BEGIN CERTIFICATE-----
...operator-provided public CA...
-----END CERTIFICATE-----
</ca>

If the client supports inline blocks, prefer the operator's inline profile over a hand-assembled one. Inline material travels with the profile and survives re-import, while an absolute path breaks the moment the profile moves to another machine.

Read the Next Error, Not the Same One

The point of supplying the correct CA is to change the error, not to make it disappear. A server-identity failure after the CA loads means the certificate did not match the expected name or the remote-cert-tls expectation, which is a different repair from a password rejection. A password rejection means the TLS layer succeeded and the credential is wrong. Keep the first new message; it is the useful one.

A client that connects but cannot reach anything has moved past trust entirely and now faces a routing or DNS question.

Never disable verification to get past that dialog. A client that accepts any certificate has no reason to ask for a CA, and the tunnel it builds is not the one the operator intended.