We recently installed a pfSense based firewall which with little fuss generated an OpenVPN installer that contains no client side certificates. Most members of our team have used OpenVPN in some capacity or another over the last 10 years and have always had client side certificates as part of the installation. As a result a debate has ensued questioning if the tunnel is encrypted if there is no client side certificates. After quite a lot of searching we cannot come to a definitive conclusion.
We recognize the value of client side certificates, but for just for purposes of knowledge with account and password based authentication and no client certificates is OpenVPN an unencrypted tunnel?
We did use Wireshark and generate some simple UDP traffic with netcat and it appeared encrypted, but for the nay-sayers this was not enough evidence. The docs do not clearly state that the tunnel is always encrypted although they do discuss not using client side certificates and even mention that since 2.0 secure exchange of account and password data is available without client side certificates.
Is there citable documentation that supports a conclusion?