I've created a private x509 pki structure with openssl that consists of a self signed Root CA, an Intermediate CA and two Signing CA's. The signing CA's are used to separate the signing of certificates for OpenVPN servers and clients as suggested at the bottom of the Security notes section of the OpenVPN HOWTO.
Sign server certificates with one CA and client certificates with a different CA. The client configuration ca directive should reference the server-signing CA file, while the server configuration ca directive should reference the client-signing CA file.
This is all configured and working correctly working correctly. However, I have two separate OpenVPN servers for which I'd like to have separation of access. At the moment a client certificate I've issued for one server will work to access the other server as they're both validated through the same CA certification chain.
How do I separate the usage of the client certificates without creating a separate signing CA for each VPN server?