Background:

I have a multi-tenant c++ grpc server, where each tenant brings their own CA. So, grpc server loads the right CA issued cert when the client connects with the appropriate hostname (tenantId.server.com). Now, a tenant goes and update the CA keys. At this point, all new clients will have new CA issued cert/key material. And old clients continue to use old CA issued cert/key material. So the server, have to support multi-CA issued certs (old CA and new CA) for a given tenant till all clients gets the new CA issued certs.

Approach:
Today, clients connect to server using “tenantId.server.com”, so grpc library resolves the server cert by matching the CN. Is it possible extend the cert resolver logic (grpc server) to match by both CN and AKI (authority key identifier) when a client connects to server using “tenantId.server.com/aki”?

I could not find documentation on how to extend SNI resolver logic in c++. Any help is appreciated.