It’s easy to state that economic layers (like floors) are prohibiting you to evolve dynamically. Like a panacea of not confirmed status quo, it drains your capacity to embark on tasks, directed to you.
Nonetheless, OpenVPN GNOME dialog box is explaining clearly, that missing CA certificate will not be a prerequisites met status to add a connection. It assumes developer with password connection mode will provide CA.pem connections file to the box and it will allow it to add.
Now, network kernel TUN requested module is a supplementary part, running OpenVPN server, node client mode. It cannot be an excuse that client side is tricking tricks with you, whatsoever. The server issuer should send you a CA.pem file issued by them to you in order to connect to their side.