---
title: Changes in Web Agent 2025.x
description: There are no incompatible changes in this release.
component: web-agents
version: release-notes
page_id: web-agents::changes-2025
canonical_url: https://docs.pingidentity.com/web-agents/release-notes/changes-2025.html
section_ids:
  web_agent_2025_11: Web Agent 2025.11
  web_agent_2025_9: Web Agent 2025.9
  iaic-am-compatibility: Advanced Identity Cloud and AM compatibility
  web_agent_2025_6: Web Agent 2025.6
  public-client-cert-file-change: Public client certificate file name property
  support_for_sslv3: Support for SSLv3
  des_password_replay: DES Password Replay
  web_agent_2025_3_x: Web Agent 2025.3.x
  web_agent_2025_3: Web Agent 2025.3
  content_security_policy_header_frame_ancestors: Content Security Policy header - frame-ancestors
  agent_authentication_to_advanced_identity_cloud_and_am: Agent authentication to Advanced Identity Cloud and AM
  am_6_5: AM 6.5
  glibc_support: Glibc support
---

# Changes in Web Agent 2025.x

## Web Agent 2025.11

There are no incompatible changes in this release.

## Web Agent 2025.9

### Advanced Identity Cloud and AM compatibility

This version of Web Agent includes changes required for compatibility with future releases of Advanced Identity Cloud and AM.

|   |                                                                                                                                                                                 |
| - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | To maintain compatibility with upcoming Advanced Identity Cloud and AM releases, you must upgrade to one of the following Web Agent versions:- 2025.9

- 2024.11.2

- 2023.11.3 |

## Web Agent 2025.6

### Public client certificate file name property

We've made changes to the use of the [Public Client Certificate File Name](https://docs.pingidentity.com/web-agents/2025.11/properties-reference/com.forgerock.agents.config.cert.file.html) property for agents using Schannel.

This property should now be used only for the name of the file that contains the client certificate chain.

Use the new [Public Client Certificate Friendly Name](https://docs.pingidentity.com/web-agents/2025.11/properties-reference/com.forgerock.agents.config.win.clientcert.friendly.name.html) property to set the friendly name used to look up the client certificate in the Windows certificate store.

### Support for SSLv3

Support for SSLv3 was removed for Windows Secure Channel API (Schannel).

### DES Password Replay

Support for setting up password replay for IIS agents using DES was removed because it's not FIPS 140-3 compliant.

Use the JWT password replay mechanism instead as documented in [Configure basic authentication and password replay support](https://docs.pingidentity.com/web-agents/2025.11/installation-guide/install-iis.html#iis-enable-basic-auth).

## Web Agent 2025.3.x

There are no incompatible changes in the Web Agent 2025.3.1 maintenance release.

### Web Agent 2025.3

#### Content Security Policy header - `frame-ancestors`

By default, the Content Security Policy (CSP) `frame-ancestors` directive is set to `self`, which only allows the site hosting the agent to embed pages in iframes. If you use iframes with another source, you'll need to set the new properties appropriately.

Learn more in [Content Security Policy - `frame-ancestors`](whats-new.html#csp-frame-ancestors).

#### Agent authentication to Advanced Identity Cloud and AM

The default fallback mode setting (`0`) for [AM\_AGENT\_AUTH\_MODE](https://docs.pingidentity.com/web-agents/2025.11/installation-guide/installer-env-vars.html#am-agent-auth-mode) and [Agent Authentication Mode](https://docs.pingidentity.com/web-agents/2025.11/properties-reference/com.forgerock.agents.config.agent.auth.mode.html) has been removed. The default setting is now `1` meaning the agent always authenticates using the `Agent` journey.

If the `Agent` journey doesn't exist, you should create it. Learn more in [Authenticate agents to the identity provider](https://docs.pingidentity.com/web-agents/2025.11/installation-guide/pre-installation.html#authenticate_agents_to_the_identity_provider).

#### AM 6.5

AM 6.5 has reached End of Life (EOL) and is no longer supported.

#### Glibc support

Glibc 2.17 is no longer supported. Glibc 2.28 is the minimum version supported on Linux.