Most of your question should be answered here:
OpenVPN -cipher vs -tls-cipher?
Still, because your question is slightly different focussed, let me provide you a simplified list of steps performed in an OpenVPN connection setup, and which keys are used where:
The client connects to the server. If
tls-crypt is used, this packet and all following control channel packets are authenticated or authenticated-and-encrypted with this key by both parties.
The client and server perform a TLS handshake over the control channel. Both use the
ca keys for the TLS authentication. The server uses the
dh parameters if an DH(E) cipher suite is used. TLS uses one of the cipher suites allowed by the
Over the TLS secure channel (which has it's own encryption) OpenVPN performs the OpenVPN key exchange.
The keys resulting from this OpenVPN key exchange are used to encrypt-and-authenticate data channel packets (the actual virtual network packets). The data channel uses the encryption and authentication methods specified by the
auth options, or a cipher negotiated over the control channel, which is one of the ciphers in the
ncp-ciphers option (the latter is OpenVPN 2.4+ only).
This means that the keys in
ca are used only by TLS, and in the same way that TLS (or, the TLS library) does. The TLS ciphersuite specifies the authentication type of the server. So if you only allow RSA cipher suites, the server must have an RSA privkey/cert, but the client may still use a different certificate.