My software system is running a cloud infrastructure where having Linux machines VPN into OpenVPN gateway is a setup requirement. Also, there may be cases when software on the aforementioned Linux machines may need to access cloud infrastructure when not VPN'ed into the gateway.
During the setup of OpenVPN gateway, I've created a local certificate authority (via easy-rsa) to issue client certificates for OpenVPN to encrypt traffic with and authenticate.
Now I need to generally identify a client machine connecting to my Node.js (or any, for that matter) backend. I wonder if I could use the OVPN issued certificates for this. If the client connecting to a backend can present a certificate, then I know who they are and will serve the required resources.
Is this a good practice to do so? The other way around would be to leave OpenVPN certificates be and just have some other layer of authorization for client machines, but that seems to be a bit of a duplication given I already have a CA and certs on the client side.