Device Identity for ChromeOS

Chrome Enterprise provides policy enforcement, certificate and profile deployment, and inventory and posture signals, but ChromeOS cannot cryptographically prove the hardware origin of certificate requests. This leaves gaps where cloned VMs can impersonate Chromebooks, certificates can be copied to unmanaged devices, and device identity remains weak for Wi-Fi, VPN, and SSO. As a result, Zero Trust enforcement breaks down across mixed OS fleets and SaaS access cannot be consistently constrained by device trust.

Smallstep closes these gaps by adding cryptographic, hardware-attested device identity to ChromeOS using Chrome Verified Access. This enables enforceable Zero Trust across Wi-Fi, VPN, SSH, SaaS, and internal applications, with device identity grounded in hardware rather than software claims.

Smallstep standardizes device identity across heterogeneous environments by anchoring trust in hardware, not operating systems. Windows and Linux use TPM 2.0 attestation, macOS and iOS rely on Secure Enclave with managed device attestation, ChromeOS uses Verified Access, mobile platforms leverage hardware-backed keys where supported, and virtual machines are attested via vTPM across AWS, GCP, Azure, and VMware.

Every device receives short-lived, continuously renewed, hardware-attested certificates. Identity remains consistent regardless of OS, device ownership, or network location, eliminating drift between platforms and enforcing a single trust model across the entire fleet.

MDMs focus on configuration and control: enforcing policies, managing compliance, and deploying applications. Smallstep operates at a different layer, providing hardware-validated device identity, automated certificate lifecycle management, attestation-based inventory gating, and cryptographic authentication across mTLS, SSH, EAP-TLS, and VPN, with device trust signals enforced directly into SSO flows and a unified audit trail.

In short, MDMs ensure devices are configured correctly. Smallstep ensures devices are authentic, continuously verified, and cryptographically trusted—closing the gap between policy enforcement and actual identity assurance.

Smallstep modernizes Wi-Fi security by replacing shared secrets and static profiles with hardware-bound EAP-TLS certificates. Wi-Fi onboarding is automated through MDM, authentication is enforced via hosted or on-prem RADIUS with built-in device trust, and support for WPA3-Enterprise and Suite-B 192-bit enables strong cryptography. Unmanaged or unattested devices are blocked, and short-lived certificates ensure automatic revocation without manual cleanup.

The result is the elimination of password-based Wi-Fi, weak PEAP/MSCHAPv2 authentication, SCEP profile theft, MAC spoofing, and long-lived certificates that linger after devices are gone. Smallstep makes Zero Trust Wi-Fi operationally realistic at enterprise scale.

Smallstep upgrades VPN authentication from passwords/PSKs to IKEv2/mTLS with hardware-attested certificates: Only verified devices can initiate VPN tunnels

Certificates rotate automatically

No VPN credentials to distribute or steal

Supports all major VPN appliances (Cisco, Fortinet, Palo Alto, AWS, Azure, GCP, strongSwan)

Per-user, per-device policy enforcement

VPN becomes identity-based, not perimeter-based.

Smallstep SSH replaces static keys and long-lived access with short-lived SSH certificates issued through SSO, with optional device-bound enforcement and ephemeral user provisioning via NSS/PAM. Authorization is encoded directly into certificates using role-based policies, and every access event is fully auditable end to end.

This eliminates SSH key sprawl, shared root credentials, vault-stored keys, manual rotation projects, and persistent server access. SSH becomes a Zero Trust workflow that is cryptographically enforced, continuously validated, and operationally clean.

Smallstep extends SSO beyond user identity by enforcing device trust directly in the authentication flow. Every login requires a hardware-backed mTLS certificate, which Okta, Entra, or Google validate before issuing tokens, blocking token replay, session hijacking, and access from unmanaged or spoofed devices.

This model enforces device trust consistently across SaaS and cloud platforms including Google Workspace, Microsoft 365, GitHub and GitLab, Salesforce, AWS, GCP, Azure, and internal admin consoles. SSO becomes a combined user + device decision, not a user-only assertion.

Smallstep ZTNA secures access using hardware-attested device identity combined with mTLS and MASQUE/HTTP/3 tunnels, enabling per-application access without exposing the underlying network. This removes reliance on legacy VPN concentrators while enforcing Zero Trust at the application layer instead of the network edge.

Access controls are applied consistently across browsers, CLI tools, SSH, and APIs, not just web traffic. ZTNA becomes universal and protocol-agnostic, rather than a browser-only workaround.

Smallstep fully automates the entire certificate and identity lifecycle, from hardware-backed key generation and attestation through certificate issuance, short-lived rotation, policy-based renewal gating, and revocation. Service reloads for platforms like NGINX, Envoy, Redis, and Postgres are handled automatically, with full visibility through centralized logs and metrics.

As a result, IT teams are removed from manual certificate operations entirely. Identity shifts from a brittle, ticket-driven process to a continuously operating service.

Smallstep upgrades IAM by introducing device identity as a first-class authentication factor alongside users. The IdP handles user authentication, Smallstep verifies hardware-backed device identity, and access policies require both an approved user and an approved device, with users and groups synchronized via SCIM.

This allows high-risk applications to explicitly require attested device trust without changing how IAM manages identities. IAM remains responsible for users, while Smallstep owns device and workload identity enforcement.

Smallstep enforces immediate revocation by design through short-lived, hardware-attested certificates that must continuously renew to remain valid. Removing a device from inventory blocks renewal, MDM wipes or posture failures prevent re-attestation, TPM or Secure Enclave resets break the hardware identity, and user offboarding halts certificate issuance at the source.

The result is automatic access removal across Wi-Fi, VPN, SaaS, SSH, ZTNA, and internal services without manual cleanup or lag. Loss of trust anywhere causes access to disappear everywhere.

With Step CA Pro and Run Anywhere, organizations can deploy Smallstep entirely within their own environments. This includes on-premise certificate authorities and attestation services, customer-managed HSM-backed private keys, private RADIUS, VPN, SSH, and ZTNA infrastructure, as well as fully air-gapped or sovereign cloud deployments such as GovCloud or Azure Government.

This deployment model aligns with strict regulatory and compliance requirements, including SOC 2, PCI-DSS, HIPAA, FedRAMP, NIST 800-207 Zero Trust, CJIS, and Department of Defense standards, without relying on external trust dependencies.

Smallstep implements Zero Trust by shifting access control from the network to identity. Devices are hardware-attested, authentication is continuous through short-lived certificates, and access is enforced using role-based, policy-driven controls rather than static network placement.

All internal traffic is protected with mTLS and SSH, with full auditability across device, user, and workload identity. The result is a cryptographically strong Zero Trust foundation that applies uniformly across the entire enterprise.

Adoption is phased and incremental, starting with a focused pilot such as Wi-Fi, VPN, SSH, or SSO device trust. From there, organizations roll out hardware-backed device identity, modernize Wi-Fi and VPN, deploy Zero Trust SSH, enforce SaaS device trust through Okta or Entra, expand into ZTNA, and finally secure internal services with workload identity and mTLS.

Because Smallstep integrates directly with existing MDMs, identity providers, VPNs, and network infrastructure, each phase builds on what is already in place. Deployment progresses without rip-and-replace disruption.