Dear Maintainer,

Duo has announced that their root certificate for Duo clients needs to be
replaced before Febuary 26, 2026. Fore more information see
https://help.duo.com/s/article/9451?language=en_US

The new certificate bundle was added to the client source code in May 2025
in the 2.1.0 release.

Per the referenced announcement, action is required by 20260202, not
20260226:

"To avoid authentication or service disruption, update all affected
applications and clients that connect to Duo’s servers to the latest CA
pinning bundle version by February 2, 2026"

Ok, things will break in 5 days and nobody seems to care? Is the maintainer no longer active?

This has a drop dead date of March 31, 2026. What is the status of this? If this doesn't get resolved at Debian's level, we need to look at using Duo's repo and configs. Thank you.
All affected Duo products have new versions available which contain root certificates with redundant and varied certificate authorities to safeguard against this need in the future.


  *
Soft Cut-Over: After February 2, 2026, older Duo versions still using expiring bundle may begin to fail authentication.
  *
Hard Cut-Over: On March 31, 2026, unsupported versions will stop working entirely.

Hi all

I'm a DD but not the maintainer of this package, and this bug affects me
(I discovered earlier in the week). I will try and help fix the issue
in Debian.

It looks like a minimal fix might be

https://github.com/duosecurity/duo_unix/pull/324

but I have not yet verified this.

I will try and prepare updated packages for Debian unstable, stable and
oldstable, but I won't have time to work on this until Thursday.

I'm actually not sure what happens on the 31st March as it's already
100% failing for me, I think. However if it will help someone I will try
and see if we can get things fixed in all releases by 31st March, using
the stable-updates suite.

If anyone is willing to help QA these updates, please feel free to contact
me offlist, with the Debian release(s) you are running. You would need
to be available to test things on Thursday or Friday.

Thanks
Dominic

In actual fact, the minimal fix doesn't work, because the servers block
old clients by version number (hence the 403 errors I was seeing in the
logs, which I had assumed were a confusing translation of cert errors
into HTTP errors).

I think the only resolution to this is going to be to upgrade to the
new upstream release, which is doable for Debian unstable, although I
haven't been able to get that far today. Assuming I do get to it in a few
days, this still won't be of immediate help for stable users, since it's
a large change that I don't think would be approved for stable. But at
least it could be backported.

Dominic

Version: 1.11.3-1+b1

Followup-For: Bug #1113899



Dear Maintainer,



   * What led up to the situation? Daily usage stopped working. Likely due to certificate change, but possibly other reason.

   * What exactly did you do (or not do) that was effective (or

     ineffective)? Running login_duo manually and checking

     /var/log/syslog showed error, 'HTTP 403'.

   * What was the outcome of this action? Failed, no push prompted, logged 'HTTP' 403.

   * What outcome did you expect instead? Duo push to happen normally.



Followup, installed Duo's duo-unix 2.2.3 on same system,  this worked correctly.