My current setup involved a self signed root CA, which has then signed my SSL/TLS CA and my OpenVPN client CA. The SSL/TLS CA signs the certificates of my servers, and the OpenVPN client CA signs the certificates of OpenVPN clients.
Should the OpenVPN client CA be in its own hierarchy, separate from the root CA? I'm concerned that if a user imports the root CA and trusts it, someone with an OpenVPN client certificate signed by my CA could be able to use that certificate for servers, then be trusted without any further user intervention. Unless I'm missing something with
OpenSSL is being used.