title: Client certificate deleted from APIM but still accepted
body: <p>I am using client certificates in Azure API Management as described <a href="https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-mutual-certificates-for-clients" rel="nofollow noreferrer">here</a> to secure access to an API:</p>
  
  <pre><code>&lt;choose&gt;
    &lt;when condition="@(context.Request.Certificate == null || !context.Deployment.Certificates.Any(c =&gt; c.Value.Thumbprint == context.Request.Certificate.Thumbprint))" &gt;
      &lt;return-response&gt;
          &lt;set-status code="403" reason="Invalid client certificate" /&gt;
      &lt;/return-response&gt;
    &lt;/when&gt;
  &lt;/choose&gt;
  </code></pre>
  
  <p>This works all well so far. </p>
  
  <p>But: After I uploaded a client certificate, tested accessing the API with that cert (that worked), I deleted the certificate from APIM. Now I would expect that I should no longer be able to access the API but it still works. Is there some caching etc. in the background of APIM so that it could take a while until the cert does not get accepted anymore?</p>