Right now this is a hypothetical... I know I can construct two independent OpenVPN configs/instances to satisfy this particular case.
Given the following certificate hierarchy (and server certificates aside):
rootca
+ ca1
+ client1
+ client2
+ ca2
+ client3
+ client4
I would like to be able to create a configuration where the IP pool and routing was determined by the client certificate's signing CA (ie. ca1 or ca2).
For example, client3/4 could be allocated addresses from a separate pool than client1/2.
I'm not particularly interested in managing individual client configs, but having the ability to select independent ifconfig, ifconfig-pool, route, and push "route ..." options on the signing cert's CN would seem to provide a scalable solution.
