How It Works

With Smallstep, your PKI can become a unified foundation for encryption and authentication for all your devices, people and workloads: from web apps and databases to Kubernetes clusters to GitHub Actions, SSH, VPN and Wi-Fi.

We don’t do this by trying to become your identity provider, user or asset database, MDM provider, or network gateway. Instead, we leverage roots of trust that are already around you, integrate with your existing resources, and provide a platform for managing encryption everywhere in your network.

All devices registering with your Smallstep team are first added to your device trust zone (or device PKI). To register, devices can leverage existing roots of trust: a Trusted Platform Module (TPM) in Linux, an Instance Identity document or attestation token from any cloud provider, or an attestation certificate.

We rely on hardware roots of trust wherever possible, so that only your devices can register with Smallstep. The Smallstep API and IaC integrations make it easy to sync your device inventory to Smallstep. The device trust zone is a privileged trust zone. It offers an authentication factor, and it becomes a foundation for creating other trust zones.

The people and workload trust zones are dedicated to infrastructure access. Smallstep can issue certificates to people and applications by leveraging a device certificate (from the device trust zone), a Single Sign-on (SSO) token, or another authentication method. Keep managing your own directory, and Smallstep will ensure all the right attributes end up on your account certificates for the applications you need to access.

Smallstep monitors all the certificates it issues, seamlessly renewing them as needed and updating the affected services.

Smallstep builds on a foundation of trust zones for devices, workloads, and people to issue client certificates for specific applications. Account certificates are short-lived, are issued on-demand, are instantly revocable, and can combine device and user identities.

The Smallstep agent is a binary package that runs locally as a background service on devices with workloads to be managed. The agent is the backbone of the entire process and provides services such as:

This demo shows the process of registering a Linux device into the device trust zone, and deploying TLS server authentication for a Redis server.

For walk through guides for other workloads, see Getting Started.

Don’t see your workload type listed? Ask us.