{"version":"2.1.309","anchor":"gateway-customer-allowlist-date-bounded-entries-root-check","canonical_anchor":"gateway-customer-allowlist-date-bounded-entries-root-check","heading":"Stricter rules for an organization's list of trusted gateway certificates","tier":"notice","area":"Gateway Auth","scope":"org","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.309\/e\/gateway-customer-allowlist-date-bounded-entries-root-check","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.309","markdown":"### Stricter rules for an organization's list of trusted gateway certificates\n\nGateway certificate allowlist entries now need valid dates and strong root certificates, and the hostname must match exactly\n\n**Unclear.** Which gateway setups use this allowlist, and so who is affected, is not stated.\n\n**What**\n\nAn organization can give Claude Code a list of root certificates (the certificates that vouch for a server's identity) to trust when it connects through a gateway. Claude Code now checks that list more strictly:\n\n- An entry only counts if its expiry date is in the future and no more than about a year past when Claude Code was built.\n\n- A listed root certificate is skipped if it is a public one, is not allowed to vouch for other certificates, or uses a weak key.\n\n- When only one root is trusted, the server's certificate must name the exact hostname in its list of names it is valid for.\n\n**Why**\n\nThis makes it harder for a wrong or weak certificate to be trusted, and an entry that used to be accepted may now be skipped.\n\n- Area: Gateway Auth\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: org\n- Heads-up: yes"}