CTX696638 correctly identifies circular intermediate dependencies as the trigger, but framing this purely as endpoint misconfiguration understates a real robustness defect in CWA 2603’s pre-handshake validation. RFC 4158 (Certification Path Building) explicitly requires loop detection during path construction, yet CWA appears to spin until a ~5-minute wall-clock timeout instead of detecting the back-edge and failing fast. The result is a silent, unactionable hang with no clear error - particularly damaging for service providers and external/BYOD users whose certificate stores admins cannot inspect or remediate. Please add cycle detection with bounded path-building, a fast deterministic error with a clear “invalid endpoint certificate chain” message, and a policy-controlled option to retain the pre-2603 validation behavior. @Darius Shafie @Eltjo van Gulik

I’m unable to locate this behavior change anywhere in the CWA 2603 documentation - it isn’t in the What’s New / feature list, Fixed Issues, or Known Issues, and the only “certificate validation” item in 2603 is the unrelated server-side validation for Browser Content Redirection. Could anyone point me to the official documentation describing the new client-side, pre-handshake certificate chain validation introduced in 2603? As it stands, this is effectively an undocumented change to the TLS validation path that can block session launches,…