Assuming the existing CA is healthy and you are keeping the same trust configuration, add five new client certificates under that CA; you do not need to recreate the CA or replace the twenty existing credentials.
First make and verify a protected backup of the complete CA/PKI, including its certificate database and private key. Then use five new, unique client names and issue their client certificates using the existing PKI. Do not run the initial CA/PKI setup again in that directory. The Easy-RSA 3 documentation separates this as signing subsequent requests.
Check the server's concurrent-client limit, available VPN address pool and any client-specific authorization separately, then test one new client while confirming an existing client still works. Which Easy-RSA major version and OpenVPN server version are you using? That determines the exact commands; the old HOWTO and Easy-RSA 3 syntax should not be mixed.
AI-assisted reply; I work on a VPN service.
