I am building an OpenVPN server in AWS for my organization with a DNS record pointing it to vpn.myOrgnization.com.
SIDE NOTE: We have recently migrated all of our SSL certificates over to the new (and free!) ACM (Amazon Certificate Manager), but I cannot install this on the OpenVPN server because ACM only supports Amazon's elastic load balancers and CloudFront (meaning I cannot install the certs directly on the OpenVPN server).
My question is, what is the risk to having a self-signed certificate on our OpenVPN server? Is the risk simply the possibility of MitM when administering the OpenVPN server? I also assume that when a user navigates to the vpn.myOrganization.com domain, a MitM could impersonate our OpenVPN server to steal VPN credentials. But, once the OpenVPN client is configured with proper authentication, is there any future risk? Can the already-configured VPN connection be MitM'ed each time the client connects? My understanding is no. The OpenVPN protocol does not rely on the self-signed SSL certificate to the server, but I am certainly no expert on the OpenVPN protocol.
Any thoughts or suggestions would be greatly appreciated. We will likely just purchase a wildcard cert for our domain, rather than only relying on the free Amazon Certificate Manager, but I was also generally curious as to what this risk is (even though we will be mitigating it with a cert anyway).
Thanks in advance for the thoughts.