JA EN
shiichan

Cloudflare One Client for macOS beta puts device registration in the Secure Enclave!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security#infrastructure

Hey there, it's Shiichan! Today I found a handy little update for all you Mac users, so let me tell you about it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Over on Cloudflare's Changelog, the Cloudflare One Client for macOS beta (version 2026.6.782.1) just went out. The Cloudflare One Client is what you might know as WARP: the client that connects your device to Cloudflare's Zero Trust network. The headline of this beta is a security boost around device registration. If you want to try it, you can grab it from the beta releases downloads page.

The story so far

The Cloudflare One Client has always registered your device with your organization and protected that device's traffic. But the way the registration token was protected still had a bit of room to get tougher.

What changes

Now the registration token can be generated inside your Mac's Secure Enclave, whenever it's available. The Secure Enclave is a dedicated area on Apple's chips that isolates and protects keys in hardware. By creating the token there, you get much stronger protection against "device impersonation," where someone tries to pose as your device.

Registration tokens can now be generated in the Secure Enclave whenever available to provide stronger protection against device impersonation.

Because the key never leaves the hardware world, it becomes far harder to copy and carry away.

Dive Deep

Beyond security, there's a whole pile of quieter improvements that really add up.

  • Accessibility: high-contrast colors and clearly defined boundaries now follow your macOS Display settings.
  • Path MTU Discovery (PMTUD) is now enabled by default. It finds the best packet size for your path, so traffic is less likely to get stuck.
  • Fixed DNS query failures that happened after idle connections.
  • Team name registration now accepts any case format, upper or lower.

There's also a big batch of UI bug fixes: MDM configuration, session expiration handling, certificate installation errors, the Wi-Fi pause feature, surfacing Split Tunnel and Local Domain Fallback settings, proxy mode configuration, and restoring the quit option all got tidied up.

One heads-up, though: there's a known issue where registration can hang on the "Checking your organization configuration" screen. It's caused by an IPC error, and the recommended fix is to reboot your system. It's a beta, so keep that in mind while you test.

Wrap-up

  • From Cloudflare's Changelog, the Cloudflare One Client for macOS 2026.6.782.1 (beta) has arrived!
  • The highlight is generating registration tokens in the Secure Enclave, hardening protection against device impersonation.
  • Quietly useful changes too: PMTUD on by default, a fix for post-idle DNS failures, and accessibility improvements.
  • Lots of UI bug fixes across MDM, certificates, Split Tunnel surfacing, and more, though watch out for the registration hang known issue.
  • If you run Cloudflare One / WARP on Mac as an admin or engineer, it's worth a peek on the beta ahead of the crowd!

Related posts