Usually they are put in the same folder as the configuration (.ovpn
or .conf) file, that is, in
~/Library/Application Support/Tunnelblick/Configurations.
But it depends on what the configuration files themselves reference
them. The above works if the configuration files have lines like
ca ca.crt
but if the files have lines that look like
ca abc/ca.crt
then the ca.crt should be put in a subfolder, in this case
~/Library/Application Support/Tunnelblick/Configurations/abc
(but the configuration file would be outside of that folder).
I'll look into making this clearer in the documentation.