How to identify which root CA does the client certificate use?

Question

How can we identify which root CA client used when there are multiple root CAs on the server?

We can compare the public keys of the client certificate and the root certificate but if we have many root certificates this is an unnecessary overhead.

Is there any way to find out from the client certificate (x.509) which root CA (alias) is used?

Edited to add this clarification:

if the intermediate certificates in the certificate chain are not available/accessible and if the same CA issued all the multiple root certificates(e.g. different tenants), is there any other approach to match the incoming client certificate to the corresponding root certificate on the server?

Answer 1

Yes. The Issuer field in the x509 certificate is used to specify the Subject of the next certificate up in the certificate path. If you continue to recurse up the certificate chain, you'll eventually arrive at the Subject name of the root certificate.

Answer 2

It's actually not as complicated as that, your OS' Certificate Browser will do all the key checking for you. As an example, here's the cert for *.stackexchange.com viewed through the Windows Certificate Viewer. (I clicked the lock icon in Chrome, and "Certificate information")

Notice that the Issued by: field lists the display name of the issuing CA. This name is not necessarily unique, so for more details, go to the Details tab and find the Issuer field:

This lists the full Distinguished Name (DN) of the issuing CA, which will be unique within their organization, but could be spoofed I guess. To check the actual certificates

Here you can open up each of the certs in the chain and inspect them.