ICCE: The foundation of device identity

Smallstep’s platform is built on four foundational components. Certificate authorities issue short-lived certificates for devices, workloads, users, and SSH, forming the core identity primitive. Attestation services validate TPM, Secure Enclave, or Verified Access signals to confirm hardware provenance and ensure identities are rooted in real, verifiable platforms.

Enrollment and lifecycle services automate onboarding, certificate issuance, renewal, rotation, inventory synchronization, and revocation, while enforcement integrations apply cryptographic identity at access points such as EAP-TLS, VPNs, mTLS, SSH, ZTNA, SSO, and internal systems. Together, these components create a unified, cryptographically enforced identity plane designed for Zero Trust environments.

Smallstep maintains a layered trust model built on hardware-backed private keys secured by TPMs or Secure Enclaves and short-lived certificates that require periodic re-attestation to remain valid. Attestation chains are anchored to manufacturer roots, ensuring that device identity is grounded in verifiable hardware provenance.

Trust is further segmented through isolated CA hierarchies and enforced end to end with mutual TLS on internal communication channels. This design removes static trust anchors and sharply reduces attacker dwell time by continuously revalidating trust.

Smallstep’s ICCE model defines the full lifecycle of device identity. Inventory establishes an authoritative record of hardware-backed device identifiers, forming the trust baseline for all subsequent actions. Credentials are then issued as short-lived, hardware-attested device certificates that can be continuously revalidated.

Configuration securely distributes Wi-Fi, VPN, SSH, browser, and mTLS settings, while enforcement applies cryptographic identity at RADIUS, VPN gateways, SSH access, SSO, ZTNA, and internal services. Each stage is automated and secured to maintain continuous trust throughout the device lifecycle.

Smallstep separates certificate authority responsibilities to enforce strong isolation. The attestation CA validates TPM, Secure Enclave, or Verified Access attestations and issues attestation certificates that prove hardware provenance.

The device, or accounts, CA issues short-lived device identity certificates only after successful attestation, while the workload CA issues mTLS certificates for workloads such as virtual machines, pods, or services. This separation enforces least privilege and prevents certificates from being used outside their intended context.

Revoked or compromised devices are blocked through mandatory periodic hardware re-attestation and inventory-based authorization that ensures only approved devices remain eligible for certificates. Global revocation lists, MDM and EDR posture signals, agent heartbeat monitoring, and policy-based renewal gating continuously evaluate device state.

If a device fails any of these checks, it is unable to obtain new certificates, even if old certificates are copied or the system is cloned.

All communication is authenticated and encrypted using mutual TLS between agents and servers, combined with certificate pinning and strict chain validation. Short-lived authorization tokens such as nonces and OIDC tokens are used to prevent replay and limit exposure.

Trust is further segmented through intermediate CAs, and key material is protected by hardware. No privileged channel relies on static secrets or unauthenticated endpoints.

Yes, Smallstep supports cloud-hosted certificate authorities with local enforcement, on-premises registration authority mode for air-gapped or regulated environments, and distributed high-availability deployments. It also enables hybrid cloud and on-prem inventory synchronization, along with per-region RADIUS, VPN, or ZTNA relays.

Step CA Pro adds enterprise capabilities including HSM-backed keys, SQL-backed storage, clustering, and multi-region replication to support large-scale deployments.

Smallstep maintains trusted roots for TPM manufacturers such as Infineon, Intel, AMD, and STMicroelectronics, as well as for Apple platform certificates used by Secure Enclave, Chrome Verified Access, and cloud vTPM providers including AWS NitroTPM, Azure, and Google Cloud.

Each attestation includes an endorsement and attestation key certification chain, platform certificates, and a hardware-bound signature. Smallstep validates the full chain, enforces challenge binding, and issues certificates only to verified hardware.

Smallstep integrates with MDM platforms such as Jamf, Intune, and Workspace ONE to provide inventory management, posture signals, and automated device bootstrapping. It also connects with identity providers like Okta, Entra, and Google to combine user identity with device-bound SSO enforcement.

At the network and access layer, Smallstep integrates with RADIUS for Wi-Fi access, VPN gateways for IKEv2 and mTLS authentication, and ZTNA relays using MASQUE and mTLS. It also feeds audit data into SIEM and observability systems through OpenTelemetry, audit logs, and syslog. Across all of these integrations, Smallstep operates as the underlying cryptographic identity foundation.

Smallstep applies defense-in-depth by segregating root, attestation, device, and workload certificate authorities, and by using short-lived intermediate certificates to limit blast radius. Private key material can be optionally stored in HSMs, and attestation events are recorded in immutable logs.

Certificate issuance is further constrained through name restrictions, certificate linting, and strict authorization gating based on inventory, with no sharing of private keys between components. These layers ensure that even misconfiguration cannot result in broad trust failures.

Smallstep extends the same identity model used for devices to workloads across diverse environments. Kubernetes workloads are supported through step-issuer or autocert, cloud virtual machines authenticate using AWS, GCP, or Azure instance identity tokens, and virtual machines can use vTPM-based attestation. On-prem servers and IoT devices are supported through physical TPMs, and SSH host identity is established through host certificates.

Across these environments, workloads receive short-lived, context-rich mTLS certificates that enforce Zero Trust principles for service-to-service communication.

Smallstep ensures that every access decision is grounded in explicit, verifiable context. It determines who the user is, which hardware-attested and inventory-approved device they are using, and which workload identity is involved.

Access is then evaluated in real time based on policy, posture, and revocation state, and enforced over cryptographically authenticated channels such as mTLS, EAP-TLS, or SSH. Trust is continuously re-established rather than inherited from network location.