be sent because of the server - see the RFC extract quoted previously mentioned) and if that's the situation, considering the Issuer and most likely the AKI field to ascertain which Root CA issued this first https://ca-none.com/