Well, I personally never had the need og having different CAs on the same openvpn server.
ANyway there could be cases where this might be preferred, I suppose, so maybe it might make sense to bind the ca management to the tunnel and not to the whole class (wonder anyway how to manage cases (probably more common) where you want more tunnels sharing the same CA and needing $auth_type == "tls-server".

In any case I'd move all these changes to a 3.x module (cloned from something like https://github.com/stdmod/puppet-redis

Before making new modules I'm still waiting from some input on open issues, the complete lack of feedback in https://groups.google.com/forum/#!topic/example42-puppet-modules/KLtvs8E7lYo is discouraging.