APIGateway with mTLS accepts different client certificates issued by the same CA

You must include the complete chain of trust, starting from the issuing CA certificate, up to the root CA certificate, in your truststore.

What you are seeing is normal behaviour

API Gateway accepts client certificates issued by any CA present in the chain of trust.

What you require is a way to revoke the client certs:

Adding a certificate revocation list

AWS Certificate Manager Private Certificate Authority (ACM Private CA) can be natively configured with an optional certificate revocation list (CRL).

CRL is a way for certificate authority (CA) to make it known that one or more of their digital certificates is no longer trustworthy. When they revoke a certificate, they invalidate the certificate ahead of its expiration date. The certificate authority can revoke an issued certificate for several reasons, the most common one being that the certificate’s private key are compromised.

API Gateway HTTP APIs mTLS setup can be used along with all existing API Gateway authorizer options. You can further extend validation to AWS Lambda authorizers, which can be configured to validate the client certificates against this certificate revocation list (CRL).

Some info here https://aws.amazon.com/blogs/compute/automating-mutual-tls-setup-for-amazon-api-gateway/ https://docs.aws.amazon.com/apigateway/latest/developerguide/rest-api-mutual-tls.html#rest-api-mutual-tls-prerequisites