What is the magic of openvpn without ca?

Question

linux

Created an openvpn-server with minimal protection, so that mikrotiks can be connected to it. I create a connection in Mikrotik, without any certificates it calmly clings. I do the same in Windows - and she wants only with ca.crt. There are no problems, but the riddle itself is interesting.
server config:

## GENERAL ##
# TCP or UDP, port 443, tunneling
mode server
proto tcp
port 11194
dev tun
## KEY, CERTS AND NETWORK CONFIGURATION ##
# Identity
ca ca.crt
# Public key
cert server.crt
# Private key
key server .key
# Symmetric encryption
dh dh.pem
# Encryption protocol
cipher AES-256-CBC
## Network ##
server 10.8.0.0 255.255.0.0
topology subnet
# Allow client to client traffic
client-to-client
# Add route to client-to -client function
push "route 10.8.0.0 255.255.255.0"
# Ping every 10 seconds and if after 120 seconds the client doesn't respond we disconnect
keepalive 10 120
# Regenerate key each 5 hours (disconnect the client)
reneg-sec 18000
## SECURITY ##
# Downgrade privileges of the daemon
user nobody
group nogroup
# Persist keys (because we are nobody, so we couldn't read them again)
persist-key
# Don't close and re open TUN/TAP device
persist-tun
# Enable compression
## LOG ##
# Verbosity
# 3/ 4 for a normal utilisation
verb 3
# Max 20 messages of the same category
mute 20
# Log gile where we put the clients status
status openvpn-status.log
# Log file
log-append /var/log/openvpn.log
# Configuration directory of the clients
client-config-dir ccd
## PASS ##
# Allow running external scripts with password in ENV variables
script-security 3
# Use the authenticated username as the common name, rather than the common name from the client cert
username-as-common-name
# Client certificate is not required
#verify-client-cert none
client-cert-not-required
# Use the connection script when a user wants to login
auth-user-pass-verify scripts/login.sh via-env
# Maximum of clients
max-clients 1000
# Run this scripts when the client connects/disconnects
client-connect scripts/connect.sh
client-disconnect scripts/disconnect.sh

cut out the garbage, left comments

Answer 1

ca.crt - apparently the certificate of the CA that issued the certificate that is used to authenticate the OpenVPN connection. It is needed in order to confirm the authenticity of the certificate that is being used.