How to make the app work with profiles that lack a client certificate/key?
If you have a profile that connects to a server without a client certificate/key, you will need to add the following directive to your profile:
setenv CLIENT_CERT 0
This is necessary to resolve an ambiguity when the profile contains no client certificate or key, because otherwise the client app can't know whether an external certificate/key pair should be obtained from the Android Keychain, or whether the server actually doesn't require a client certificate/key (for example if the server is configured with the client-cert-not-required directive). The option is given as a "setenv" to avoid breaking other OpenVPN clients that might not recognize it.