Restricting Client Certificate CA Trust List on a Specific Listen Port

Products

• CA API Gateway

Issue/Introduction

In multi-tenant Layer7 API Gateway environments, the Gateway by default sends a comprehensive list of all Certification Authorities (CAs) marked as "Trusted for Signing Client Certificates" during the TLS handshake (CertificateRequest message).

Customers may need to restrict this list to a specific subset of CAs for a particular Listen Port without:

1. Disabling global trust for those CAs (which would break other tenants/ports).
2. Applying a global Cluster-Wide Property (CWP) that affects the entire Gateway.

Environment

Layer7 API Gateway (All supported versions)

Resolution

In the Layer7 API Gateway, it is not natively possible to pass a granular, explicit list of specific CA certificates to a single Listen Port's CertificateRequest payload while excluding others that are globally trusted.

Upcoming Product Enhancement

To address this exact requirement, we already have an active Feature Request underway. This enhancement is scheduled to be introduced in API Gateway v11.2.2, which is targeted for General Availability (GA) by the end of August 2026.

Once this version is released, you will have the granular control needed for your listen port configurations. Please let me know if you have any questions in the meantime.