How can we identify which root CA client used when there are multiple root CAs on the server?

We can compare the public keys of the client certificate and the root certificate but if we have many root certificates this is an unnecessary overhead. 

Is there any way to find out from the client certificate (x.509) which root CA (alias) is used? 

Edited to add this clarification:

if the intermediate certificates in the certificate chain are not available/accessible and if the same CA issued all the multiple root certificates(e.g. different tenants), is there any other approach to match the incoming client certificate to the corresponding root certificate on the server?

The most likely source of this information is your browser's WebRTC implementation.

You can see this in the source code of ip-api.com.

From https://github.com/diafygi/webrtc-ips, which also provides a demo of this technique:


  Firefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. These request results are available to javascript, so you can now obtain a users local and public IP addresses in javascript.


It was recently noted that the New York Times was using this technique to help distinguish between real visitors and bots (i.e. if the WebRTC API is available and returns valid info, it's likely a real browser).

There are a couple of Chrome extensions that purport to block this API, but they don't seem to be effective at the moment.  Possibly this is because there aren't yet the hooks in the browser, as that GitHub README alludes to:


  Additionally, these STUN requests are made outside of the normal XMLHttpRequest procedure, so they are not visible in the developer console or able to be blocked by plugins such as AdBlockPlus or Ghostery.

