JA EN
shiichan

The Linux Cloudflare One Client hits GA — TPM registration and DNSSEC land in stable!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security#infrastructure

Hey there, it's me, Shii-chan! Today I found an update that Linux folks are going to love.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog has a new GA release of the Linux Cloudflare One Client (version 2026.6.822.0). You can grab it from the stable releases downloads page, and a batch of features that used to live in beta have now landed in the stable channel.

The story so far

These features were available to try in beta, but rolling them out to fleet devices in production took a bit of nerve. Now that they've all reached GA together, administrators can hand them out across the org with more confidence.

What changes

There are five headline items.

  • DNS search suffixes: the client now appends the search domains you configure in your device profile to single-label queries.
  • Hardware-backed registration: with hardware-backed registration, registration tokens can be generated inside the TPM (on TPM 2.0+) for stronger protection against device impersonation.
  • Local-file signal for Emergency Disconnect: alongside the existing HTTPS polling, admins can have WARP watch for a file on disk, so an emergency disconnect can fire even when both Cloudflare and your own infrastructure are unreachable.
  • DNSSEC passthrough: the local DNS proxy forwards DNSSEC-signed responses intact (DO/AD bits and RRSIG records included), so local validation with dig or drill works correctly through the client.
  • New MDM format for org-wide settings: it offers a cleaner way to configure compliance environments such as FedRAMP.

Dive Deep

There's plenty more that matters day to day. API requests are now unified under the api.devices.cloudflare.com SNI, so if you gate traffic with SNI inspection, give that a look. Cloudflare Mesh now works on RHEL 9 and 10, and it supports hostname-based routing too.

On the finer details, certificate device-posture checks now accept template variables like ${serial_number} in the Subject Alternative Name field, and Path MTU Discovery is on by default. A proxy-mode bug that rejected hostnames containing underscores (which broke apps like ChatGPT sandbox apps) is fixed. For troubleshooting, there are new warp-cli debug commands, documented under Extra debug logging.

One heads-up for RHEL: this release adds a dependency on the EPEL repository. As a known issue, registration may hang at "Checking your organization configuration", but a reboot should clear it.

Wrap-up

  • A GA release of the Linux Cloudflare One Client (version 2026.6.822.0), moving beta features into stable together.
  • DNS search suffixes / TPM-backed registration / file-based Emergency Disconnect / DNSSEC passthrough / a new MDM format are the highlights.
  • Plus Cloudflare Mesh on RHEL 9 and 10, hostname routing, and a stack of smaller bug fixes.
  • This one lands squarely for admins running Cloudflare One (Zero Trust) on Linux devices.

Related posts