I have an application where there I'm planning the following setup:
user <-----------------> layer 1 server <------------------> backend server internet (https) RPC through VPN
So when a user makes a request, it goes through standard SSL/TLS to the layer 1 server, then that has a program that calls a software in another location through the internet, which is connected to the layer 1 server through an OpenVPN connection.
To simplify the design of my application, I'd prefer that the RPC connection is without SSL/TLS. I'm thinking of that VPN connection as a replacement to the security requirements of a TLS encrypted connection. Does this provide the same security level?
The RPC sends user/password data to the server, which it just forwards to the backend server after wrapping it with some other objects.
What are the expected drawbacks from such a design?