Register for part 2 of our Device Identity Webinar Series!

Add verified device identity to Cloudflare Zero Trust

Cloudflare decides who gets access. Smallstep verifies which devices can receive trusted certificates, with hardware-backed assurance where supported, and keeps them renewed. Strengthen device access policies without replacing Cloudflare.

Get a demo
background gradientbackground texture
Works with Cloudflare One Client and Access
Issued only to approved inventory
Hardware assurance where supported
Certificate-based device posture
Windows, macOS, Linux, ChromeOS
Automated certificate lifecycle

Cloudflare checks for a certificate. Smallstep decides which devices get one.

The client certificate posture check confirms a device holds a certificate signed by the issuer you upload. It does not ask how the device got it. Smallstep answers that: enrollment is authorized against your Jamf, Intune, or Google inventory, keys are generated in hardware where the platform allows, and renewal stops when a device leaves.

  • Cloudflare validates the certificate it is shown. Smallstep governs which devices receive one.
  • Your IdP and the Cloudflare One Client stay. You add the check to the Access or Gateway policies that should require it.

How Smallstep device identity works

Cloudflare integrates with Smallstep at two points

First, the client certificate posture check: upload the Smallstep issuing certificate, enable the private key check, and reference it in Access and Gateway policies. It verifies certificate attributes and that a private key is present; it does not prove possession or hardware residency. Second, Access mTLS: upload the Smallstep CA chain for your protected hostnames and require a certificate alongside IdP login. The TLS handshake proves key possession. Gateway cannot inspect mTLS hostnames, so bypass inspection for them.

Move from serial-number lists to attested identity

Cloudflare's serial-number and device UUID checks compare what a device reports against a list you maintain. A Smallstep certificate is issued only after the device is matched to inventory, using the strongest verification each platform supports: TPM attestation, Apple Managed Device Attestation, ChromeOS Verified Access, or other key protection.

  • Issuance follows synchronized inventory; no separate device allowlist.
  • Assurance varies by deployment; not every path is hardware-attested.

Credentials the Cloudflare One Client can read

The client reads certificates from the Windows store, the macOS System keychain, or a PEM file on Linux, so the key must live where the client can see it. Where that store cannot hold a hardware-bound key, Smallstep can issue, where supported and configured, a short-lived credential authorized by the device's attested identity, and renew it. Security depends on both issuance assurance and credential protection afterward.

Smallstep manages issuance. Cloudflare controls access.

Smallstep authorizes enrollment from your inventory and issues the certificate. The Cloudflare One Client checks it on its polling schedule and Cloudflare applies policy; Smallstep is not in the request path.

Cloudflare owns policy and enforcement. Smallstep owns which devices get a credential and how its key is protected.

Example: Intune-managed laptops enroll through the agent; an Access policy requires the posture check before an internal app loads.

How device identity and key protection work

Key benefits for Cloudflare Zero Trust customers

Certificates for authorized devices

Smallstep checks inventory and enrollment policy before issuing. Devices outside your policy cannot obtain those credentials; Cloudflare then enforces access with its configured posture and Access rules.

Hardware attestation where it exists

Smallstep uses TPM attestation, ChromeOS Verified Access, and Apple Managed Device Attestation where supported. Key protection and attestation assurance depend on the OS, enrollment method, and credential configuration.

Keep Cloudflare as the enforcement platform

Add Smallstep-issued certificates to supported posture checks and Access mTLS policies without replacing your identity provider or the Cloudflare One Client.

Nothing for users to carry

Enrollment, issuance, and renewal happen through the agent or MDM. Users pass the posture check with a managed certificate instead of a prompt.

One identity, more than one enforcement point

The same device identity can serve Wi-Fi, VPN, SSO, and SSH integrations, each with its own credential configuration and enforcement on the resource side.

Lifecycle that follows inventory

Issuance and renewal are tied to device authorization. When a device is removed, renewal stops and existing credentials run to their configured expiry. Immediate removal needs enforcement in Cloudflare.

Put issuance assurance behind the Cloudflare policies you already run.

Cloudflare keeps deciding who gets through. Smallstep governs which devices receive a certificate and how its key is protected.

Book a demo

FAQs Smallstep for Cloudflare Zero Trust

Cloudflare's client certificate posture check confirms that a certificate signed by an issuer you uploaded is present on the device, optionally with its private key, a matching common name or SAN, and client-authentication key usage. It does not evaluate how the certificate was obtained, and it does not prove possession of the key the way an mTLS handshake does. Smallstep governs the issuance step: enrollment is authorized against your MDM or inventory, keys are hardware-bound where the platform allows, lifetimes are short, and renewal stops when a device is removed. Cloudflare's policy engine stays in charge of access.

Upload the CA certificate that directly signed the device certificate; in a typical Smallstep deployment that is the issuing intermediate rather than the root. The Cloudflare One Client does not evaluate the full chain for this check, so uploading a certificate higher in the chain makes it fail. Create a Client certificate check per operating system, set the location where Smallstep installs the certificate, enable the private key check, and optionally match the common name or SAN and the client authentication EKU. Then reference the check in Access or Gateway policies.

Cloudflare documents the client certificate check for Windows, macOS, and Linux, with minimum client versions from 2024. It is not available for iOS, Android, or ChromeOS. For supported mobile deployments Cloudflare offers a managed Unique Client ID (device UUID) check; serial-number lists are for Windows, macOS, and Linux. Neither list-based check is a certificate check or provides cryptographic assurance.

It depends on the platform. The Cloudflare One Client reads from the Windows machine or user store, the macOS System keychain, or a PEM certificate and key on Linux. Where that location cannot hold a hardware-bound key, Smallstep can issue, where supported and configured, a short-lived provisioned credential, using the device's established identity to authorize issuance; that identity is hardware-attested on some platforms and Smallstep-attested on others. Key protection depends on the operating system and credential configuration: some credentials can use hardware-protected keys, others need software-protected keys for compatibility. Cloudflare checks the certificate and its private key but does not attest the key's hardware residency, so where a key is exportable, a copied certificate and key could pass the check on another otherwise authorized device until expiry. Confirm the key protection model for each OS in your fleet with us before you set policy expectations.

Cloudflare's documentation describes a signature, validity, private key, name, and EKU check; it does not describe CRL or OCSP evaluation. Plan on short certificate lifetimes and stopped renewal as the removal mechanism, and treat active revocation as a separate control on resources that check it.

By default the Cloudflare One Client polls posture every five minutes, and Access detects changes at that rate. Gateway caches posture results for a further five minutes and evaluates posture only at the start of a session; an active session is not terminated when a later check fails. These are Cloudflare behaviors and are independent of Smallstep.

The posture check is evaluated by the Cloudflare One Client on the device and can gate Access and Gateway policies. Access mTLS is a TLS handshake at the edge: you upload the Smallstep CA chain for specific hostnames, and Access requires a client certificate from the browser or application, either as a second factor after IdP login or as service authentication without an IdP. Access mTLS is available on Enterprise and pay-as-you-go plans, and Gateway cannot inspect traffic to mTLS-protected hostnames, so those domains need an inspection bypass.

Not necessarily. The posture check reads a certificate from the OS store and needs the CA certificate that directly signed it uploaded; Access mTLS needs a certificate the browser or application can present and the CA chain uploaded per hostname. These can be different Smallstep credential profiles with different issuers, locations, and OS support. Decide which path each resource uses and configure the profile for it; do not assume one certificate serves both.

Where the browser can reach the key. On macOS the Smallstep agent exposes Secure Enclave credentials to browsers such as Chrome and Firefox; these are Smallstep-attested, not Apple Managed Device Attestation. On Windows and Linux the agent provides device-attested browser credentials. Agentless macOS enrollment through MDM supports Safari only. See the key protection table in the Smallstep documentation for the current matrix.

For the posture check path, the agent is the usual route on Windows, macOS, and Linux because it places and renews the credential where the client reads it. Agentless MDM enrollment can issue hardware-bound certificates on supervised Macs for Apple's first-party services and Safari; whether the Cloudflare One Client can read one from the System keychain has not been validated, so plan on the agent for Cloudflare posture until it is.

You can export inventory from Smallstep or your MDM and load it into a Gateway serial-number list by CSV or API; a direct list sync would need an additional integration. That gives a managed-device check on Windows, macOS, and Linux without certificates, but a serial number is self-reported and is not cryptographic evidence. Use the certificate check wherever it is available.

Remove the device from inventory, by removing it from the MDM or in Smallstep, and issuance and renewal stop; the certificate runs to its short expiry. The posture check does not evaluate CRL or OCSP and Cloudflare does not query Smallstep inventory, so the certificate may continue to satisfy the posture check until it expires or another Cloudflare control denies access. For immediate removal, act in Cloudflare as well: revoke the device registration and remove its ability to re-enroll, disable the user in your identity provider, and revoke applicable Access sessions. Certificate revocation alone does not guarantee immediate denial across these controls.

No. Cloudflare's hardware-backed registration, off by default and available on Windows and Linux with TPM 2.0 and Apple silicon Macs, binds the Cloudflare One Client's own registration to a non-exportable device key so a stolen API token cannot be replayed elsewhere. It protects the client's registration; it does not attest a separately installed client certificate or govern who may obtain one. Smallstep governs device certificate issuance against approved inventory and provides credentials for access systems beyond Cloudflare. Use both.

No. This page is about using Smallstep certificates inside Cloudflare's own checks. Smallstep also offers Enterprise Relay, a MASQUE-based identity-aware relay, which some teams run beside WARP for internal domains that must be reachable only from attested devices. It is an option for specific destinations, not a prerequisite for the integration above.

Smallstep can extend device identity beyond Cloudflare to supported Wi-Fi, VPN, SSO, SSH, and internal application integrations. Each needs its own credential configuration and enforcement on the resource side; for example, Smallstep can act as an additional device identity factor in supported Okta or Entra sign-in flows.