{"version":"2.1.309","anchor":"oidc-ca-cert-error-messages-now-say-which-certs-to-supply","canonical_anchor":"oidc-ca-cert-error-messages-now-say-which-certs-to-supply","heading":"OIDC certificate errors now say exactly which certificates to provide","tier":"notice","area":"Gateway Auth","scope":"org","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.309\/e\/oidc-ca-cert-error-messages-now-say-which-certs-to-supply","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.309","markdown":"### OIDC certificate errors now say exactly which certificates to provide\n\nErrors about blocked certificates in `oidc.ca_cert_pem` now ask for the provider's intermediates and self-signed root, with no cross-signed ones\n\n**What**\n\nWhen certificates in the gateway's `oidc.ca_cert_pem` setting are on Claude Code's deny list, the error and warning messages have been reworded. They now tell you to set `oidc.ca_cert_pem` to the identity provider's intermediate certificates plus the self-signed certificate of the root named as their issuer, with no cross-signed certificates. An identity provider is the service that signs people in. Before, the message only asked for the authority that issued the provider's current certificate.\n\n**Why**\n\nIf your gateway sign-in setup trips this check, the message now tells you what to put in the setting to fix it.\n\n- Area: Gateway Auth\n- Names: `oidc.ca_cert_pem`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: org\n- Heads-up: no"}