How does a client verify that the OpenVPN server certificate was signed by the master CA?
Based on OpenVPN setup clients are usually supplied with only their own certificate and private key and CA certificate.
How does a client verify that the OpenVPN server certificate was signed by the master CA?
Based on OpenVPN setup clients are usually supplied with only their own certificate and private key and CA certificate.
Like David Houde already said, OpenVPN usually uses a single CA to sign both client and server certificates. In case you have problems understanding how signing/verificating certificates works, you should read Using digital certificates in digital signatures first.
If the client receives a server certificate, he simply checks whether this certificate was signed by the CA he was provided with. If the check succeeds, the server is accepted.
Usually the server certificate also contains a parameter for extended key usage named "TLS Web Server Authentication". This parameter may be checked for by adding the following statement to your OpenVPN config:
remote-cert-eku "TLS Web Server Authentication"
This is used to ensure the server certificate provided to the client is actually what it claims to be. Otherwise another client could possibly identify himself as a server, since the same CA does sign both types.