Smallstep solves the missing half of Zero Trust

Traditional Zero Trust implementations remain rooted in network controls such as segmentation, firewalls, VPN boundaries, and IP-based policy. These models still assume implicit trust within defined network zones, creating fragile boundaries where location and network placement substitute for actual verification.

Smallstep enforces Zero Trust at the identity layer instead of the network layer. It verifies user, hardware-attested device, and workload identity on every request—not just at login—using cryptographically authenticated channels like mTLS, SSH, and EAP-TLS. This removes reliance on trusted networks or machine location, ensuring access is based solely on short-lived, continuously re-proven identities.

Smallstep issues and enforces identity across far more than just servers. It covers managed devices using TPM or Secure Enclave attestation, cloud workloads using AWS, GCP, and Azure identity tokens and vTPM, Wi-Fi clients via EAP-TLS, VPN clients through IKEv2 and mTLS, SSH users and hosts with short-lived SSH certificates, browsers and SaaS login flows using mTLS combined with SSO, and internal APIs and microservices secured with workload mTLS.

This creates a single, unified identity framework spanning devices, users, workloads, networks, and applications. Organizations can adopt Zero Trust end-to-end without stitching together separate tools for each access path or trust domain.

Zero Trust demands authentication at every resource boundary, not just at the moment of login. Treating login as the security checkpoint is a legacy shortcut that breaks down once access becomes continuous, automated, and machine-driven.

Smallstep enforces this model through short-lived certificates measured in minutes or hours, periodic device re-attestation, and certificate renewal that is gated on inventory, posture, and policy. Service-to-service communication is enforced with mTLS, and any expired or non-attested identity is automatically rejected. Every access request must originate from a currently valid, hardware-attested identity—no exceptions, no lingering trust.

Software-based identity can be spoofed, cloned, or replayed, which makes it an unreliable foundation for Zero Trust. Tokens, secrets, and files can be copied; environments can be impersonated; sessions can be hijacked.

Hardware-based attestation changes the trust model by anchoring identity in non-exportable private keys backed by manufacturer-signed platform certificates, with cryptographic proof of where the key was generated. This resists device cloning, VM replay, credential theft, and browser token or session hijacking. With Smallstep, ACME Device Attestation becomes the root of trust for all access decisions.

In a true Zero Trust model, both who you are and what device you’re using must be verified together. User identity without device assurance is incomplete trust.

Smallstep integrates with IdPs like Okta, Entra, and Google so that during SSO login the browser presents a hardware-backed mTLS certificate, the IdP queries Smallstep to validate the device identity, and access is granted only if the user–device pair meets policy. This blocks token replay, session hijacking, SSO access from unmanaged devices, and compromised machines using otherwise valid credentials. Only verified user–device pairs are allowed to authenticate.

Most Zero Trust tools stop at the browser, which leaves the rest of the enterprise running on legacy trust. That’s a blind spot, not a strategy.

Smallstep extends Zero Trust across every access path: Wi-Fi using EAP-TLS with no passwords, PSKs, or MAC spoofing; VPN via IKEv2 and mTLS where devices must be attested to establish a tunnel; SSH with short-lived certificates bound to both user and device; databases like Postgres, MySQL, and Redis authenticated with mTLS; internal APIs and microservices secured with workload identity and mTLS; and developer tools such as Git and Terraform using client certificate authentication. Zero Trust applies to all entry points, not just SaaS apps.

Smallstep is built for heterogeneous, multi-cloud, and hybrid environments where consistency is usually the first thing to break. Identity can’t depend on a single cloud, region, or network topology.

It supports native workload identity across AWS, Azure, and GCP, vTPM-based identity for virtual machines, Kubernetes clusters spanning multiple providers, on-prem servers and VMs, and edge or IoT devices equipped with TPMs. With multi-region certificate authority and attestation distribution, identity remains consistent and enforceable even when networks, regions, and clouds do not.

Zero Trust depends on rapid, global revocation without relying on brittle mechanisms like CRLs or long-lived trust. If access lingers after compromise, the model has already failed.

Smallstep achieves this through short-lived certificates that enable passive revocation, renewal gating that actively denies access based on policy, online revocation via OCSP in Step CA Pro, and revocation triggered by inventory changes, posture shifts, or attestation failure. A revoked or compromised device loses access within minutes, automatically, without operator intervention.

Smallstep does not replace EDR, MDM, or NAC—it fills the gap they all leave behind. Those tools address posture, management, or network control, but none of them establish a cryptographically strong root of trust.

EDR and MDM can assess device posture, and NAC can enforce identity-bound network access, but hardware attestation, continuous attestation, end-to-end Zero Trust for SaaS, and full certificate automation are missing or only partially implemented across those stacks. Smallstep enforces cryptographic identity anchored in hardware, making access decisions that cannot be spoofed, replayed, or bypassed.

Zero Trust initiatives usually fail for one reason: operational complexity. The controls are sound, but the overhead of managing certificates, devices, and revocation overwhelms teams.

Smallstep removes that friction by automating device enrollment and hardware attestation, certificate issuance and renewal, revocation and posture gating, deployment of Wi-Fi, VPN, SSH, and browser certificates, workload certificate rotation, and full CA lifecycle management. Teams get real Zero Trust enforcement without manual certificate operations or brittle, human-driven processes.

Zero Trust is not a single deployment—it’s a progression. Organizations mature through stages as identity coverage, enforcement depth, and operational discipline increase.

Smallstep aligns cleanly with each stage of that journey: starting with mTLS for internal workloads using step-ca, extending to hardware-backed device identity through ACME Device Attestation, binding users to verified devices via SSO integrations with Okta and Entra, hardening networks with Wi-Fi EAP-TLS and VPN mTLS through RADIUS and VPN integrations, and ultimately enforcing full Zero Trust with continuous verification using short-lived certificates and pervasive attestation. Smallstep scales with organizational maturity instead of forcing a big-bang redesign.

Yes—but with controlled, explicit assurance levels instead of one-size-fits-all trust. Not every device or user is equal, and Zero Trust breaks when teams pretend they are.

Smallstep enforces this by requiring hardware attestation for corporate devices, allowing software-only identity with reduced access for BYOD, applying policy-driven segmented access for contractors and partners, and restricting sensitive applications to attested devices only. This model aligns directly with NIST and DoD Zero Trust guidelines.

Zero Trust only works when every identity dimension is verified and continuously enforced. Partial implementations leave gaps that attackers exploit.

Smallstep covers every critical element: device identity verified through hardware attestation, workload identity validated via cloud or orchestrator metadata, user identity enforced through SSO, and policy applied consistently across Wi-Fi, VPN, SSH, SSO, ZTNA, and API boundaries. Continuous authentication is enforced with short-lived certificates, and revocation happens immediately through renewal gating and posture checks. Smallstep functions as the cryptographic control plane that real-world Zero Trust infrastructure requires.