Saved on device, I have TLS certificate private key, which I would like to encrypt with AES256; password will be simple PIN.
I would also like to use this same PIN as a secondary protection for some user actions. The salt and hash of this PIN will be saved on server. PIN will also serve as a secondary protection in authentication process.
What is your opinion on using this PIN to encrypt private key and also use it in other (authentication) ways? Since I want to keep it simple, I'd like to stick with one key if possible.
My thought is to use some sort of KDF (PBKDF2HMAC?) to stretch the simple PIN as the result password, but I am not sure if it is enough.
Edit: I should have mentioned that I am performing mutual certificate authentication, there goes the need for TLS certificate private key as mentioned in discussion below.