You can just send SIGINT signal to openvpn and it will stop gracefully.
https://openvpn.net/community-resources/controlling-a-running-openvpn-process/
Running on Linux/BSD/Unix
OpenVPN accepts several signals:
SIGUSR1 -- Conditional restart, designed to restart without root privileges
SIGHUP -- Hard restart
SIGUSR2 -- Output connection statistics to log file or syslog
SIGTERM, SIGINT -- Exit
Here another info from openvpn manual:
SIGNALS
SIGHUP Cause OpenVPN to close all TUN/TAP and network connections, restart, re-read the configuration file (if any), and
reopen TUN/TAP and network connections.
SIGUSR1
Like SIGHUP`, except don't re-read configuration file, and possibly don't close and reopen TUN/TAP device, re-read key files,
preserve local IP address/port, or preserve most recently
authenticated remote IP address/port based on --persist-tun, --persist-key, --persist-local-ip and --persist-remote-ip options respectively (see above).
This signal may also be internally generated by a timeout condition, governed by the --ping-restart option.
This signal, when combined with --persist-remote-ip, may be sent when the underlying parameters of the host's network interface
change such as when the host is a DHCP client and is
assigned a new IP address. See --ipchange for more information.
SIGUSR2
Causes OpenVPN to display its current statistics (to the syslog file if --daemon is used, or stdout otherwise).
SIGINT, SIGTERM
Causes OpenVPN to exit gracefully.