Hm, that sounds like a lot of work, and a bit too indirect. If the only
necessary selection criteria is the listener, then that should be used
explicitly. One thing that we've often talked about is why the listener
isn't part of the config data, instead of only supplied on the
command-line...
I'm also skeptical about the motivation for this discussion. If you have
separate certs from separate CAs, then you really have distinct security
domains so I don't understand why you need them to share databases. You
might as well just run separate slapds.