[SR-Users] routing based on TLS auth

Hi. I've got bunch of sip gateways to use and bunch of asterisk instances connecting to my Kamailio over TLS (own CA used). I'd like to match source with destination based on TLS authentication: * all the calls from asterisk A (TLS cert A) allowed via provider A * all the calls from asterisk B (TLS cert B) allowed via provider B ... * all the incoming calls from provider A forwarded to asterisk A (TLS cert A) * all the incoming calls from provider B forwarded to asterisk B (TLS cert B) ... * calls not coming from provider X or via TLS dropped. Providers are regular VoIP gateways (login:password, connection via SIP). I'm pretty sure this is possible with Kamailio but I'd appreciate any examples and pointers to modules I should use to implement this. Or detailed explanation of why this is a bad idea. Also, I'm not sure where it's better to place user database - should it be separate on per-asterisk basis? Central in Kamailio? No user db needed at all? cheers, Max.