Skip navigation
Duo Blog
Admin Login
Documentation

Duo Trusted Endpoints Certificate Migration Guide

Last Updated: November 21st, 2024

Contents

Related

Certificate-based Trusted Endpoint verification reached end-of-life on October 7, 2024. Review this document carefully as you plan your migration.

Overview

When Duo introduced Trusted Endpoints it relied on the presence of a certificate issued by Duo on endpoints accessing protected services. We have moved away from device certificates to alternative methods of identifying trusted devices that leverage Duo Mobile on Android and iOS devices, or Duo Desktop on Windows and macOS computers. This strategy provides the following benefits:

  • Reduced administrative tasks: Using Duo Desktop for Trusted Endpoints eliminates the work associated with managing certificate infrastructure and renewals.

  • Consistent and reliable experience: Get a more reliable Trusted Endpoints experience across a variety of web browsers and thick client applications by using Duo Desktop instead of certificates to report endpoint characteristics to Duo. Mobile device users will also receive a more uniform experience across iOS and Android when you migrate to an integration that uses Duo Mobile for trust in place of certificates.

  • Expanded browser support: Duo Desktop app supports authentications in all major browsers, including Firefox. Duo device certificate detection does not support Firefox.

  • Improvements for shared endpoints: With certificate-based management integrations, device certificates are associated with users rather than devices, preventing detection of the endpoint as a trusted device when shared by multiple people.

End-of-Life Information

As part of the shift away from certificates for identifying trusted endpoints, management integrations based on issuing Duo Device Trust certificates reached end-of-life on October 7, 2024.

After October 7, 2024:

  • Legacy certification management integrations may still be present in the Duo Admin Panel, but you should not use them after October 7.
  • Certificate-based trust configurations may stop working without any additional notification or warning. Use at your own risk.
  • Duo support teams can no longer provide troubleshooting assistance with blocked authentications due to certificate-based trust failures. Duo can assist with migration issues.

New device trust certificates will not be issued and existing certifications will not be renewed after October 2024.

The following legacy integrations reached end-of-life on October 7, 2024:

We recommend planning to transition your existing integrations to use Duo Desktop for desktop or Duo Mobile for mobile device verification now. Some Trusted Endpoints integrations are ready to migrate to replacement solutions now while other integrations are in development. See the Device Trust Solution Availability section for details.

Device Trust Solution Availability

Continue with Your Current MDM

The following integrations, which previously supported certificates, can now be upgraded to use Duo Mobile or Duo Desktop for identifying trust. This is the easiest migration option as it only requires a configuration change in the Duo Admin Panel:

Note that while Sophos Mobile does support replacing certificates on iOS with Duo Mobile, this MDM has reached end-of-life by the vendor and will subsequently reach end-of-support from Duo in a future release.

Switch to Alternative MDM

The following integrations require migrating to a different MDM solution that supports Duo Mobile or Duo Desktop:

Non-MDM Solutions

The following integrations use Duo Mobile or Duo Desktop for identifying trust and don't require an MDM:

  • Duo Mobile as Trusted - offers integration with Duo Mobile without an MDM based on the mobile access device successfully completing second-factor device registration

  • Generic Duo Desktop Integrations - offers integration with Duo Desktop on Windows and macOS for organizations with an MDM that doesn't have a named integration or a custom integration with no MDM.

  • Manual Enrollment with Duo Desktop - offers integration with Duo Desktop for small organizations without an MDM

Integrate Without Duo Mobile or Duo Desktop

The following integrations do not require Duo Desktop or Duo Mobile:

Additional Resources

Please refer to these additional resources to plan your migration from certificate-based management integrations: