What is Changing
We are removing older ciphers from the suite supported by Workspot Control. It is possible that sufficiently old and unsupported Workspot Clients will no longer be able to connect.
We are shifting to new DNS nameservers. It is possible that your DNS infrastructure will not adjust to this automatically.
Removal of Older Ciphers
On August 10, 2025, from 3:30-4:30 UTC, Workspot will be upgrading the US Workspot Control tenant to remove support for older ciphers:
TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c)
TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d)
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)
TLS_RSA_WITH_AES_256_CBC_SHA (0x35)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH secp521r1 (eq. 15360 bits RSA)
TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c)
Action Required: Update Clients to Supported Versions
Older, unsupported versions of Workspot Clients have not been tested against any recent Control environment. Their functionality is not guaranteed. If you still use such unsupported versions, you should update them before the date listed in this advisory.
Tested version are:
Windows Client 6.0.0 and above
Mac Client 7.1.0 and above
IOS Client version 7.2.1 and above
Android Client version 7.1 and above.
To check the versions in use, see Determining Which Workspot Client Versions are in Use.
If all your Workspot Clients are updated automatically, no action is required.
Action is required mostly for:
Windows Clients when Deployment Rings or other update utilities are not used to keep your Windows Client software current.
Mac Clients where automatic software updates are disabled.
Windows Clients 5.3.0 and above can be updated with a new version. Earlier Clients must be uninstalled before a new version can be installed.
Note: If you have restricted the cipher suite at the OS level to use only older ciphers, it is also possible that action is required.
DNS Updates
On July 29, 2025, from 0330-0430 UTC, Workspot will deploy a network load balancer in advance of the August 10, 2025 update referenced above. This ensures that the new DNS records will propagate to DNS servers globally.
Workspot does not expect any users to be impacted during this interval, since the existing DNS records will still be valid.
Action Required: DNS
Please verify that your organization’s DNS servers can see the new records. See recommendations below.
Please note:
The Workspot URLs and namespaces will not change, only the dynamic IP addresses used by the URLs and namespaces.
Workspot URLs and namespace have always used dynamic IP addresses.
Recommended Action: July 30-August 7
Perform nslookup from your organization's network and verify you see the following DNS records:
>nslookup control.us.workspot.com
Name:
cubic-kiwi-6pdgt6phpzi7ep0boxgizzs9.herokudns.com
Addresses:
Ignore (these are dynamic addresses.)
Aliases:
control.us.workspot.comworkspot-us-control.trafficmanager.netcontrol-cr.us.workspot.com
Recommended Action: August 11 or Later
Perform the nslookup again.
>nslookup control.us.workspot.com
Name:
[TBD].herokuspace.com
Note: The “TBD” portion of this name will be automatically assigned by the DNS service on August 11, 2025.
Addresses:
Ignore (these are dynamic addresses.)
Aliases:
control.us.workspot.comworkspot-us-control.trafficmanager.netcontrol-ps.us.workspot.com
Troubleshooting
If any user cannot connect on August 11, 2025:
Check the user’s Client version.
Have the user check that their device can see the new DNS records and flush the stale DNS caches on their devices.
Contacting Support
If you have any questions, please contact Workspot Support.