Field Notice: FN74372 - Action Required by March 31, 2026: Announcing Cisco Duo Certificate Authority Bundle Expiration - Software Upgrade Recommended

On April 15, 2026, Mozilla and Google Chrome will distrust DigiCert certificates in the Cisco Duo existing certificate authority (CA) pinning bundle. This out-of-band distrust event will affect all Cisco Duo products that use certificate pinning. This affects all Cisco Duo editions: Duo Free, Duo Essentials, Duo Advantage, Duo Premier, Duo Federal Essentials, and Duo Federal Advantage. All types of accounts (paid, trial, free, developer, and partner) are included.

All latest affected product releases now have a new Cisco Duo CA pinning bundle, which contains root certificates issued by a variety of certificate authorities for future redundancy.

In anticipation of this expiration and to manage disruptions and provide support, Cisco Duo will impose a soft cutoff of the expiring CA bundle on February 2, 2026. The change for Cisco Duo products will be permanent on March 31, 2026.

CA Certificate Pinning

A CA is a TLS Certificate Authority. When TLS clients (like web browsers or applications that call the Cisco Duo APIs) connect to a server, they check whether the server has a TLS certificate that is signed by a CA that the client trusts and that matches the server domain name.

If the server does not have a signed, matching certificate, the client immediately closes the connection without sending any data. Most applications simply trust whatever CAs the operating system or browser is configured to trust. The defaults vary slightly between platforms but generally include all CAs that meet the rules set by the CA/Browser (CAB) Forum.

If an application or library deploys its own list of trusted CAs (instead of trusting any CA that the platform where the application runs has been configured to trust), it is said to be pinned to its included CAs. This allows custom criteria for which CAs the code trusts.

What happens if action is not taken by February 2, 2026?

Cisco Duo applications that rely on certificate pinning that are not updated by the February 2, 2026, soft cutoff will start to experience connectivity disruption that day, with increasing disruption frequency throughout February 2026 unless there is an approved extension in place. The affected clients could fail to connect to the Cisco Duo cloud service to authenticate users, receive login requests (such as Duo Push requests), import users, or perform management operations through APIs.

Use this time to upgrade or retire remaining affected client applications as shown in the Unsupported Clients Log Admin Panel Report before the March 31, 2026, final deadline.

What happens if action is not taken by March 31, 2026?

Cisco Duo applications that rely on certificate pinning that are not updated before the March 31, 2026, final deadline will fail to connect to the Cisco Duo cloud service to authenticate users, receive login requests (such as Duo Push requests), import users, or perform management operations through APIs. No extensions will be honored.

Important: Applications that are configured to fail open will do so, allowing access without Cisco Duo authentication. Application access will be blocked if the application does not offer a configurable fail mode or if a fail closed configuration was chosen.

Solution

Due to the CA certificate expiration date, Cisco Duo is unable to provide an extension beyond March 31, 2026. Customers must update Cisco Duo software, according to the following table: 

If no workaround is available, then failure to update affected applications by this deadline will result in the outcomes that are described in the Guide to Update Duo Software.

Workaround

Some Cisco Duo applications may have a workaround available, which could consist of the following:

• Making a configuration change at the client system to disable certificate pinning and CA verification.
• Downgrading to a release of the affected Cisco Duo application that does not perform certificate pinning.
• Manually replacing the CA bundle file at the client.

Note that any workaround is not intended as a permanent solution because it may lessen the security of the Cisco Duo application. It also may not persist across updates or local configuration changes. Using a workaround may also require that an approved extension be in place so that clients using the workaround are not affected by the February 2, 2026, soft cutoff. For more information, contact Duo Support.

This affects all Cisco Duo editions: Duo Free, Duo Essentials, Duo Advantage, Duo Premier, Duo Federal Essentials, and Duo Federal Advantage. All types of accounts (paid, trial, free, developer, and partner) are included.

For information about specific releases, see the Guide to Update Duo Software.