Thank you for your help. We were able to connect to an OPC-UA server per CA-signed certificate and auto trust. Not sure if this is a common use-case but maybe the manual can be improved here. Anyway thank you 
It's not as common, but should be better documented.
I think in the ideal vision of the future, users aren't doing any of this configuration manually, and all of the OPC UA applications are managed by a GDS instead.
We support the GDS in the server but not yet for client connections.