Good you document this clearly but this seems like a limit we need to increase. If certificates need rotation we need to have the building blocks. I think we at least need support for 4 (two for each).

This brings a point that we should rather move all the certs handling into mender-mcu core repo. Right now in the core we define if there will be one or two, but then is the application (mender-mcu-integration or any other user application) that will add the certs via tls_credential_add(...). Instead, we can (and should?) have the mender client init function add the certs.

I suggest we create a task for this and do not modify the README further. In the task we shall write that the README needs to be updated accordingly.

I don't quite see how this is part of the mender-mcu (client) scope. In my eyes, this is part of the "environment", just like the network setup (including TLS support) and other similar things.

That is a valid point (and the original point for having it out of Mender hands).

But it gets tricky for us when down in the code zsock_setsockopt needs to know the CA tags (up to 4).

At least we should think about how to simplify this part 🤔 We could maybe have yet another callback to get this TLS_SEC_TAG_LIST from the user.

To move the topic forward: discuss in next client team meeting and create a task either for moving it to mender-mcu (most likely not) or other ideas for decoupling it a bit (like mine above or others).