Encode JSON Web Token assertion does not recognize Default SSL key changes - Layer7 API Gateway

Products

• CA API Gateway

Issue/Introduction

When the Default SSL key of a Layer7 API Gateway is updated (e.g., via Graphman), the Encode JSON Web Token and Decode JSON Web Token assertions continue to use the old key material for signing or validation until the Gateway service is restarted. This occurs even if refreshOnKeyChanges properties are enabled.

Environment

• Layer7 API Gateway 11.x
• Graphman Client

Cause

The behavior is by design. To ensure runtime consistency and prevent server instability, updates to core identifiers—such as the Default SSL key—require a server restart to take effect safely. The DefaultKeyImpl.cachedSslInfo material is not invalidated at runtime for JWT assertions. This specific refresh capability was explicitly excluded from the scope of the "Refresh Listen Ports" feature

Resolution

A Gateway restart is required to pick up changes to the Default SSL key for JWT assertions. To avoid the need for restarts, adopt one of the following strategies:

1. Use a Dedicated Private Key (Recommended):
   • Create a dedicated cryptographic key exclusively for JSON Web Token (JWT) encoding and decoding.
   • Update the policy to reference this specific key alias instead of the "Default SSL Key".
   • Dedicated keys are not subject to the same global SSL caching and will typically pick up rotations via Graphman within 5 seconds without a restart.
2. Explicit Key Reference Workaround:
   • In the Encode JSON Web Token assertion properties, explicitly declare and reference the key by its alias rather than selecting the "Default SSL Key" option.