Caddyfile: Which Certificate Authority is used for tls_client_auth <automate_name> (h.TLS.ClientCertificateAutomate) if multiple are defined in pki configuration

Help
1

1. The problem I’m having:

I defined two CAs in pki config and thought about using tls_client_auth <automate_name> with a domain name rather than specifying two paths. However, after reading the docs and searching for a bit I don’t get which CA is used for this part. Is it always “local”, is it the first that appears in pki? As it is not (yet) an error I am getting, I will refrain from pasting logs here.

2. Caddy version:

podman exec -it caddy caddy version
v2.11.4 h1:XKxkMTgNSizEvKG6QHue6cAsFOteU2qA61w2tKkCWi0=

3. How I installed and ran Caddy:

I don’t think my domain names are significant, as it’s an issue I am having with documentation/my own lack of knowledge.

a. System environment:

Alpine Linux (PostmarketOS), aarch64, podman.

b. Command:

{
        pki {
                ca my_ca {
                        intermediate_lifetime 10d
                        name "My Local CA"
                        renewal_window_ratio 0.4
                }
                ca my_mtls {
                        intermediate_lifetime 10d
                        name "My mTLS Local CA"
                        renewal_window_ratio 0.4
                }
        }

}
(snippet) {
        reverse_proxy {args[0]}:443 {
                transport http {
                        tls
                        tls_trust_pool file /data/caddy/pki/authorities/my_ca/root.crt
                        tls_client_auth caddy.internal
                }
}

c. Service/unit/compose file:

this is irrelevant

d. My complete Caddy config:

this is also irrelevant

4. Links to relevant resources:

Caddyfile docs:

Where I found “h.TLS.ClientCertificateAutomate”: 💥 PoW Bot Deterrent (git.sequentialread. com/sqr/caddy/src/tag/v2.4.0-beta.2-forest/modules/caddyhttp/reverseproxy/caddyfile.go#L686)