I find myself needing something similar. Historically, my server's
used SHA1 certificates, and I want to move to SHA256 certificate, but
I've got embedded clients which are hard to change, so I need to
support both, at least for a while.
Can I persuade OTP to offer a different server certificate depending
on the client?
I can't use (e.g.) SNI, because the client doesn't provide the