# The Linux Cloudflare One Client hits GA — TPM registration and DNSSEC land in stable!

Hey there, it's me, Shii-chan! Today I found an update that Linux folks are going to love.

## What was announced?

Cloudflare's Changelog has a new GA release of the Linux Cloudflare One Client (version 2026.6.822.0). You can grab it from the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/), and a batch of features that used to live in beta have now landed in the stable channel.

## The story so far

These features were available to try in beta, but rolling them out to fleet devices in production took a bit of nerve. Now that they've all reached GA together, administrators can hand them out across the org with more confidence.

## What changes

There are five headline items.

- **DNS search suffixes**: the client now appends the search domains you configure in your [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) to single-label queries.
- **Hardware-backed registration**: with [hardware-backed registration](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/hardware-backed-registration/), registration tokens can be generated inside the TPM (on TPM 2.0+) for stronger protection against device impersonation.
- **Local-file signal for Emergency Disconnect**: alongside the existing HTTPS polling, admins can have WARP watch for a file on disk, so an emergency disconnect can fire even when both Cloudflare and your own infrastructure are unreachable.
- **DNSSEC passthrough**: the local DNS proxy forwards DNSSEC-signed responses intact (DO/AD bits and RRSIG records included), so local validation with dig or drill works correctly through the client.
- **New MDM format for org-wide settings**: it offers a cleaner way to configure compliance environments such as FedRAMP.

## Dive Deep

There's plenty more that matters day to day. API requests are now unified under the `api.devices.cloudflare.com` SNI, so if you gate traffic with SNI inspection, give that a look. [Cloudflare Mesh](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/) now works on RHEL 9 and 10, and it supports hostname-based routing too.

On the finer details, certificate device-posture checks now accept template variables like `${serial_number}` in the Subject Alternative Name field, and Path MTU Discovery is on by default. A proxy-mode bug that rejected hostnames containing underscores (which broke apps like ChatGPT sandbox apps) is fixed. For troubleshooting, there are new warp-cli debug commands, documented under [Extra debug logging](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging).

One heads-up for RHEL: this release adds a dependency on the EPEL repository. As a known issue, registration may hang at "Checking your organization configuration", but a reboot should clear it.

## Wrap-up

- A GA release of the Linux Cloudflare One Client (version 2026.6.822.0), moving beta features into stable together.
- DNS search suffixes / TPM-backed registration / file-based Emergency Disconnect / DNSSEC passthrough / a new MDM format are the highlights.
- Plus Cloudflare Mesh on RHEL 9 and 10, hostname routing, and a stack of smaller bug fixes.
- This one lands squarely for admins running Cloudflare One (Zero Trust) on Linux devices.