Scheduled Service Change: Duo Certificate Authority (CA) bundle expiration
Event:
2026-03-31 00:00:00
Expected Duration:
2026-03-31 00:00:00
Status:
Closed
Brief Description:
On March 31, 2026, unsupported versions of Duo software will no longer receive Duo Push requests or be able to complete Duo Mobile-based verification. This change was originally scheduled to go into effect on February 2, 2026.
User Impact:
Users who do not update the mobile app will not be able to log in, and Duo integrations, such as to support SSH logins to servers, that are not upgraded may disallow login.
Services Affected:
Authentication and Authorization
Subsites Affected:
NetIDs
Two-Step Login
Full Description:
On March 31, 2026, unsupported versions of Duo software will no longer receive Duo Push requests or be able to complete Duo Mobile-based verification. This change was originally scheduled to go into effect on February 2, 2026. Duo has since adjusted their timeline.
Over the course of February and March, older Duo versions may stop receiving push notifications and will have increasing difficulty in successfully completing authentication. On March 31, anyone using an unsupported version of the app will be unable to authenticate.
If you are having trouble using Duo, please update your mobile app. Learn more about how to tell if you are using an unsupported mobile device, if your app is out of date, and what options are available to you.
Over the course of February and March, older Duo versions may stop receiving push notifications and will have increasing difficulty in successfully completing authentication. On March 31, anyone using an unsupported version of the app will be unable to authenticate.
If you are having trouble using Duo, please update your mobile app. Learn more about how to tell if you are using an unsupported mobile device, if your app is out of date, and what options are available to you.
CIT TDX ID:
2084746
Timeline of Changes
| Description | Current Status | Date | Time |
|---|---|---|---|
On March 31, 2026, unsupported versions of Duo software will no longer receive Duo Push requests or be able to complete Duo Mobile-based verification. This change was originally scheduled to go into effect on February 2, 2026. Duo has since adjusted their timeline. Over the course of February and March, older Duo versions may stop receiving push notifications and will have increasing difficulty in successfully completing authentication. On March 31, anyone using an unsupported version of the app will be unable to authenticate. If you are having trouble using Duo, please update your mobile app. Learn more about how to tell if you are using an unsupported mobile device, if your app is out of date, and what options are available to you. |
2026-03-04 | 16:44:23 | |
On Monday, February 2, 2026, Duo will replace their root certificate authority bundle, which will cause unsupported versions of their software to no longer receive Duo Push requests or be able to complete Duo Mobile-based verification. Additionally, any server-side integrations that are out of date and have the old certificate bundled will be unable to contact Duo’s API. Duo users must update to supported versions of the app. They have been contacted by email and notified via IT News. System administrators with outdated instances must update all affected applications and clients that connect to Duo’s servers to the latest CA bundle version before February 2, 2026. Affected application owners have been contacted. The versions listed below (and newer) include the new CA bundle:
Failure to update affected applications will prevent customers from being able to log in to Cornell services. |
2026-01-29 | 10:31:47 | |
On Monday, February 2, 2026, Duo will replace their root certificate authority bundle, which will cause unsupported versions of their software to no longer receive Duo Push requests or be able to complete Duo Mobile-based verification. Additionally, any server-side integrations that are out of date and have the old certificate bundled will be unable to contact Duo’s API. Duo users must update to supported versions of the app. They have been contacted by email and notified via IT News. System administrators with outdated instances must update all affected applications and clients that connect to Duo’s servers to the latest CA bundle version before February 2, 2026. Affected application owners have been contacted. The versions listed below (and newer) include the new CA bundle:
Failure to update affected applications will prevent customers from being able to log in to Cornell services. |
2026-01-12 | 09:13:38 |