openvpn: the -ca directory is sealed too.