diff --git a/apps/emqx_gateway/src/emqx_gateway_conf.erl b/apps/emqx_gateway/src/emqx_gateway_conf.erl
index 2aba5bff0..af858921a 100644
--- a/apps/emqx_gateway/src/emqx_gateway_conf.erl
+++ b/apps/emqx_gateway/src/emqx_gateway_conf.erl
@@ -392,7 +392,7 @@ pre_config_update(_, {load_gateway, GwName, Conf}, RawConf) ->
     case maps:get(GwName, RawConf, undefined) of
         undefined ->
             NConf = tune_gw_certs(fun convert_certs/2, GwName, Conf),
-            {ok, emqx_map_lib:deep_merge(RawConf, #{GwName => NConf})};
+            {ok, emqx_map_lib:deep_put([GwName], RawConf, NConf)};
         _ ->
             badres_gateway(already_exist, GwName)
     end;
@@ -403,7 +403,7 @@ pre_config_update(_, {update_gateway, GwName, Conf}, RawConf) ->
         _ ->
             Conf1 = maps:without([<<"listeners">>, ?AUTHN_BIN], Conf),
             NConf = tune_gw_certs(fun convert_certs/2, GwName, Conf1),
-            {ok, emqx_map_lib:deep_merge(RawConf, #{GwName => NConf})}
+            {ok, emqx_map_lib:deep_put([GwName], RawConf, NConf)}
     end;
 pre_config_update(_, {unload_gateway, GwName}, RawConf) ->
     _ = tune_gw_certs(
@@ -439,12 +439,12 @@ pre_config_update(_, {update_listener, GwName, {LType, LName}, Conf}, RawConf) -
             badres_listener(not_found, GwName, LType, LName);
         OldConf ->
             NConf = convert_certs(certs_dir(GwName), Conf, OldConf),
-            NListener = #{LType => #{LName => NConf}},
-            {ok,
-                emqx_map_lib:deep_merge(
-                    RawConf,
-                    #{GwName => #{<<"listeners">> => NListener}}
-                )}
+            NRawConf = emqx_map_lib:deep_put(
+                [GwName, <<"listeners">>, LType, LName],
+                RawConf,
+                NConf
+            ),
+            {ok, NRawConf}
     end;
 pre_config_update(_, {remove_listener, GwName, {LType, LName}}, RawConf) ->
     Path = [GwName, <<"listeners">>, LType, LName],
diff --git a/apps/emqx_gateway/src/emqx_gateway_http.erl b/apps/emqx_gateway/src/emqx_gateway_http.erl
index 5216ffc15..0165efed9 100644
--- a/apps/emqx_gateway/src/emqx_gateway_http.erl
+++ b/apps/emqx_gateway/src/emqx_gateway_http.erl
@@ -485,6 +485,20 @@ reason2msg(
         "The authentication already exist on ~s",
         [listener_id(GwName, LType, LName)]
     );
+reason2msg(
+    {bad_ssl_config, #{
+        reason := Reason,
+        which_options := Options
+    }}
+) ->
+    fmtstr("Bad TLS configuration for ~p, reason: ~s", [Options, Reason]);
+reason2msg(
+    {#{roots := [{gateway, _}]}, ErrReports}
+) ->
+    fmtstr(
+        "Invalid configurations, reason: ~s",
+        [validation_error_stringfy(ErrReports, [])]
+    );
 reason2msg(_) ->
     error.
 
@@ -498,6 +512,25 @@ codestr(501) -> 'NOT_IMPLEMENTED'.
 fmtstr(Fmt, Args) ->
     lists:flatten(io_lib:format(Fmt, Args)).
 
+validation_error_stringfy([], Reasons) ->
+    lists:join(", ", lists:reverse(Reasons));
+validation_error_stringfy(
+    [
+        {validation_error, #{
+            path := Path,
+            reason := unknown_fields,
+            unknown_fields := Fields
+        }}
+        | More
+    ],
+    Reasons
+) ->
+    ReasonStr = fmtstr("unknown fields ~p for ~s", [Fields, Path]),
+    validation_error_stringfy(More, [ReasonStr | Reasons]);
+validation_error_stringfy([Other | More], Reasons) ->
+    ReasonStr = <<(emqx_gateway_utils:stringfy(Other))/binary>>,
+    validation_error_stringfy(More, [ReasonStr | Reasons]).
+
 -spec with_authn(binary(), function()) -> any().
 with_authn(GwName0, Fun) ->
     with_gateway(GwName0, fun(GwName, _GwConf) ->
@@ -542,10 +575,6 @@ with_gateway(GwName0, Fun) ->
                 lists:join(".", lists:map(fun to_list/1, Path0))
             ),
             return_http_error(404, "Resource not found. path: " ++ Path);
-        %% Exceptions from emqx_gateway_conf:convert_certs/2,3
-        error:{bad_ssl_config, Reason0} ->
-            Reason = emqx_gateway_utils:stringfy(Reason0),
-            return_http_error(400, ["Bad SSL config, reason: ", Reason]);
         Class:Reason:Stk ->
             ?SLOG(error, #{
                 msg => "uncatched_error",