Hi!
SNI (Server Name Indication), part of TLS could do this but I would not bet that phones actually send this.
If you are able to host on different IPs, it would work with internal + external profiles:
<!--
SIP and TLS settings.
-->
<X-PRE-PROCESS cmd="set" data="sip_tls_version=sslv23"/>
<!-- Internal SIP Profile -->
<X-PRE-PROCESS cmd="set" data="internal_auth_calls=true"/>
<X-PRE-PROCESS cmd="set" data="internal_sip_port=5060"/>
<X-PRE-PROCESS cmd="set" data="internal_tls_port=5061"/>
<X-PRE-PROCESS cmd="set" data="internal_ssl_enable=false"/>
<X-PRE-PROCESS cmd="set" data="internal_ssl_dir=$${base_dir}/conf/ssl"/>
<!-- External SIP Profile -->
<X-PRE-PROCESS cmd="set" data="external_auth_calls=false"/>
<X-PRE-PROCESS cmd="set" data="external_sip_port=5080"/>
<X-PRE-PROCESS cmd="set" data="external_tls_port=5081"/>
<X-PRE-PROCESS cmd="set" data="external_ssl_enable=false"/>
<X-PRE-PROCESS cmd="set" data="external_ssl_dir=$${base_dir}/conf/ssl"/>
At least for 1.6.x I am not aware of multi cert for same profile, docs for 1.8.x are limited (as the users does not know what he does not know ;-) )
Maybe nginx can also solve this as a transparent proxy. I did something like this using Kamailio for a large cluster setup.
Kevin