Why OpenVPN is using both certificates and DH?

Key pairs are used for two things:

• Encrypting a secret value for symmetric encryption
• Signing data for validation

Both RSA and DH are based in asymmetric algorithms. So we have two cases for a secure exchange to occur.

RSA

Alice signs a message to Bob, and encrypts the message with Bob's public key. Sends message to Bob. Bob decrypts with his private key. Verifies the signature to ensure that Alice sent it. The message is going to be a symmetric encryption key. This is what's used to secure the connection.

DH

The Diffie Hellman exchange relies on two separate entities generating a secret value. Through some math magic they're both able to generate a common secret value. This common secret is what is used as a symmetric key or to derive symmetric keys. But these secret values that are generated by each side are generated at the time of need. They don't have an identity associated with them.

That last part is why you might need both. Using RSA you can have a key pair that will do both encryption and signing. With DH you only perform the encryption, there is no signing mechanism. So you need an RSA certificate in order for you to validate the DH data that you're sending.

So why use Diffie Hellman? Because DH is the basis for Perfect Forward Secrecy. Which is better explained in this answer.

In OpenVPN, the certificates and private keys you generate for client and server is used to authenticate each side. Note that you should first build a Certificate Authority (CA) which is used to issue the previous certificates for client and server.

The DH is used for Key Exchange. The DH parameters are sent to client allowing it to generate a shared pre-master secret (the "key"). Then a master secret will be generated from that pre-master secret and used to encrypt communication data.