Okta is Enabling Support for TLS 1.3 Across Okta Services

Okta is transitioning its edge infrastructure to global public IP addresses and enabling TLS 1.3 support across all Okta IDaaS services. All Okta IDaaS customers using Custom Domains and implementing strict firewall allow-lists to restrict outbound network traffic may be impacted.

• Custom Domains
• TLS 1.3

Why is Okta making these changes? 

Okta is upgrading its edge infrastructure to enhance network resiliency, reduce latency, strengthen DDoS protection, and enforce TLS 1.3 protocol standards. This migration shifts outbound connectivity from regional endpoints to global public IP addresses across Okta IDaaS TLS, LDAPI, Kerberos, Custom Domains, and mTLS traffic. TLS 1.3-enabled endpoints fully support backward compatibility with TLS 1.2. Full details regarding updated IP ranges are available in the Okta IP Address Allow-Listing Guide.

How will this affect my organization?

For most customers there will be no impact and no action is required. Customers who DO NOT use firewall allow-lists will experience no service impact.

If your organization is using Custom Domains and enforces strict firewall allow-lists but does not update them prior to completion of the rollout, your firewall may reject outbound connections to Okta. This would cause a loss of authentication for Custom Domains traffic.

We are rolling out these changes slowly starting on November 16, 2026 and should complete in March 2027 across all cells. We anticipate the slow rollout will take several months to ensure we reduce risk and impact to customers by giving them time to make changes. 

To prevent potential service outages, administrators must execute the following actions immediately:

1. Audit Firewall Configurations: Determine whether your network environment uses outbound firewall allow-lists for Okta traffic.
2. Update Allowed IP Ranges: Cross-reference your organization's Okta cell with the updated global public IP list.
3. Apply and Verify Rules: Update your firewall allow-lists to permit outbound traffic to the new global public IP addresses before the target date.

Rollout Schedule

Please note that these dates are subject to change to ensure the smoothest possible transition for customers.