The SMP logs are flooded with warnings like this:
"Certificate worker call rejected: performed with invalid certificate scope by request: xxx.xxx.xxx.xxx" (the Internet Gateway server).
Clients do not seem to be stopped at the Internet Gateway server.
ITMS 8.6
This was fixed in the cumulative Pointfix v10 for ITMS 8.6 RU3 and is fixed in ITMS 8.7 RU1.