Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- The three official announcements confirm one fix: an issue building trusted certificate chains. They do not say it resolves every browser or client certificate error.
- The 2026.4.1391.0 download cards are dated November 10. When checked, the latest-stable links for all three systems pointed to 2026.8.2115.0, whose cards are dated October 20 and list the same fix.
- Check the current OS, CPU architecture and resource requirements, then use an organization-approved release track and matching package. Linux packages must also match the distribution.
- A download or update prompt does not establish that a device has updated. Record the version actually running and retest the connection that failed.
What the hotfix explicitly addresses
On November 10, 2026, Cloudflare published separate GA announcements for Cloudflare One Client 2026.4.1391.0 on Windows, macOS and Linux, stating that stable releases were available on its official download page. The documentation uses Cloudflare One Client for the client formerly called WARP.
All three announcements describe a fix for an issue building trusted certificate chains. A certificate chain is the path linking a certificate through its issuers to a trusted certificate authority; the confirmed scope here is that client fix. The announcements give no CVE, severity, complete affected-version range or list of error messages. They do not establish that this issue causes any particular TLS warning.
A newer announcement does not make 1391 the latest on every track
When checked, the official stable-download cards for 2026.4.1391.0 on all three systems were dated 2026-11-10. The latest-stable links pointed to 2026.8.2115.0, whose cards were dated 2026-10-20 and listed the same certificate-chain hotfix. Keep the version numbers and dates separate; a later announcement does not establish that every user should switch to 1391.
Cloudflare recommends stable releases for production and separately offers beta and LTS tracks, with extended support for LTS. First identify your organization-approved track and the version actually running, then check the corresponding release notes. If you already run a higher version, do not downgrade to 2026.4.1391.0 solely because of this announcement. This article has not verified branch end-of-support dates or interpreted the announcement as an automatic update or mandatory migration notice.
Check the current OS and architecture requirements first
The Windows table lists Windows 10 LTSC, Windows 11, and Windows 365 Cloud PC running Windows 11. It supports AMD64/x86-64 or ARM64/AArch64 and requires .NET Framework 4.7.2 or later. Minimum resources are 3 vCPUs, 4 GB RAM and 250 MiB disk; recommendations are 4 vCPUs, 8 GB RAM and 500 MiB disk. Windows 10 LTSC does not mean every Windows 10 edition.
The macOS table lists Sequoia 15.1+, Tahoe 26.0+ and Golden Gate 27.0+, explicitly excluding 15.0.x, on Intel or M series processors. Minimum requirements are 3 CPU cores, 8 GB RAM and 1 GiB disk; 4 CPU cores are recommended.
The Linux table lists RHEL 9/10, Debian 12/13, Fedora 43/44, and Ubuntu 22.04, 24.04 and 26.04 LTS, on AMD64/x86-64 or ARM64/AArch64. Minimum resources are 3 vCPUs and 250 MiB disk, with 1 GB RAM without a desktop or 4 GB with one. Recommendations are 4 vCPUs, 500 MiB disk, and 2 GB or 8 GB RAM respectively. On RHEL 9 and later, also check the official note about enabling EPEL for client UI dependencies.
These are the requirements on the current download page, not a compatibility guarantee for every historical package. All three tables list Wi-Fi or LAN and recommend an MTU of 1381 bytes; their footnotes allow a minimum of 1281 with Path MTU Discovery. Meeting an MTU value alone does not establish that a particular connection works.
Record package selection, the actual update and connection checks separately
As an operational checklist, first record the device OS, architecture, version actually running and the time of the original error. Have an authorized administrator choose the target version. Use the matching official Windows or macOS entry; on Linux, select the distribution and architecture or use the officially linked package repository. An AlmaLinux ARM64 link is not a generic Linux installer.
After completing your organization’s existing update procedure, read the client version actually running and retest the target connection that failed, retaining before-and-after error details. This sequence is a recommendation. This article has not downloaded, installed or tested the client, or established that an account has received an automatic update.
If the error persists, continue investigating the target site, certificate details and organization configuration; this announcement does not identify a unique cause. Do not substitute disabled certificate validation or an untrusted certificate for the hotfix. One successful connection after an update also does not establish that every application has recovered.
Sources
Frequently Asked Questions
Does this announcement confirm the same-version fix on iOS, Android or ChromeOS?
No. The three announcements reviewed explicitly cover Windows, macOS and Linux. The download page has separate mobile and ChromeOS sections, but the desktop/Linux 2026.4.1391.0 announcements do not establish the same release for those platforms.
Will updating guarantee that every website certificate warning disappears?
No. The official notes describe a client issue building trusted certificate chains, without mapping every error to a root cause or guaranteeing that a target website’s certificate or an organization’s trust configuration is correct. Retest the specific failed connection and retain any remaining errors for further investigation.