Duo Trusted Endpoints Certificate Migration Guide

Overview

When Duo introduced Trusted Endpoints it relied on the presence of a certificate issued by Duo on endpoints accessing protected services. We have moved away from device certificates to alternative methods of identifying trusted devices that leverage Duo Mobile on Android and iOS devices, or Duo Desktop on Windows and macOS computers. This strategy provides the following benefits:

• Reduced administrative tasks: Using Duo Desktop for Trusted Endpoints eliminates the work associated with managing certificate infrastructure and renewals.

• Consistent and reliable experience: Get a more reliable Trusted Endpoints experience across a variety of web browsers and thick client applications by using Duo Desktop instead of certificates to report endpoint characteristics to Duo. Mobile device users will also receive a more uniform experience across iOS and Android when you migrate to an integration that uses Duo Mobile for trust in place of certificates.

• Expanded browser support: Duo Desktop app supports authentications in all major browsers, including Firefox. Duo device certificate detection does not support Firefox.

• Improvements for shared endpoints: With certificate-based management integrations, device certificates are associated with users rather than devices, preventing detection of the endpoint as a trusted device when shared by multiple people.

End-of-Life Information

As part of the shift away from certificates for identifying trusted endpoints we will end support for management integrations based on issuing Duo Device Trust certificates in a future release.

To prepare for this end-of-life milestone, we recommend planning to transition your existing integrations to use Duo Desktop for desktop or Duo Mobile for mobile device verification now. Some Trusted Endpoints integrations are ready to migrate to replacement solutions now while other integrations are in development. See the Device Trust Solution Availability section for details.

Device Trust Solution Availability

The following replacement solutions are ready, and we recommend you begin your migration now:

• Active Directory Domain Services (AD DS) - replacing certificates with Duo Desktop on Windows

• Jamf Pro - replacing certificates with Duo Desktop on macOS

• Microsoft Intune - replacing certificates with Duo Desktop on Windows and Duo Mobile on iOS

• Ivanti Neurons for MDM (formerly known as MobileIron Cloud) - replacing certificates on iOS with Duo Mobile

• Ivanti Endpoint Manager Mobile (formerly known as MobileIron Core) - replacing certificates on iOS with Duo Mobile

• Sophos Mobile - replacing certificates on iOS with Duo Mobile

• Workspace ONE - replacing certificates on iOS with Duo Mobile; added support for Duo Desktop on macOS and Windows

• Cisco Meraki Systems Manager - replacing certificates on iOS with Duo Mobile

Users of the following certificate-based management integrations with macOS and Windows endpoints should migrate to Generic Duo Desktop integrations, where Duo Desktop matches an endpoint's device identifiers collected during authentication to trusted device identifiers you uploaded to Duo via the Device API.

• LANDESK (Ivanti)

• Generic integrations for other Windows and macOS endpoint management tools

• Manual Enrollment

Additional Resources

Please refer to these additional resources to plan your migration from certificate-based management integrations:

• How to migrate from certificates to Trusted Endpoints with Duo Desktop

• How to migrate to Trusted Endpoints iOS integrations with App Config

• Options for installing Duo Desktop