Register for part 2 of our Device Identity Webinar Series!

Add verified device identity to printers and IoT

Not every device on your network runs an MDM. Smallstep issues certificates to the ones that can hold a client certificate and use it for EAP-TLS or mTLS: with TPM attestation where the agent runs, per-device SCEP challenges where a device is managed, and a signed certificate you load by hand where that is all the device supports. Each path carries a different level of assurance. Your NAC keeps MAB for the rest.

Get a demo
background gradientbackground texture
TPM attestation where the agent runs
Issued under inventory and enrollment policy
Per-device SCEP challenges, never a shared password
EAP-TLS where the device has a supplicant
Your NAC keeps MAB for the rest
Lifecycle matched to each device class

Embedded Linux with a TPM: the same identity as a laptop

Industrial PCs, gateways, kiosks, and robots on a supported Linux with a TPM 2.0 enroll through the Smallstep agent like any workstation: register the endorsement key by API, and the agent attests, receives a TPM-bound certificate, and renews it. It can then manage EAP-TLS, mTLS, and SSH credentials for relying parties configured to trust them.

  • Supported distributions on amd64 or arm64, systemd, connectivity to Smallstep, hardware TPM; software TPMs enroll without attestation.
Smallstep for Linux

Managed devices that speak SCEP: one challenge per device

Printers, conference room systems, and other devices enrolled in a management tool with a supported Dynamic SCEP integration get a certificate through it: the tool requests a single-use challenge from Smallstep for each device, so no enrollment secret is shared across the fleet and every certificate maps to an inventory record. This reduces unauthorized enrollment; it does not prove hardware. Static shared-challenge SCEP is not offered through this workflow.

Devices that only take a loaded certificate

Many printers, cameras, and badge readers accept a certificate through their own web interface and nothing else. If the device also has an 802.1X supplicant or mTLS client, generate the CSR on it, sign against a Smallstep authority, and install the result. The certificate is catalogued and revocable; renewal is manual, so balance lifetime against the exposure of a lost or retired device.

  • A key generated off-device is the lowest assurance class.
  • A store for the HTTPS admin page is not EAP-TLS support; check the supplicant first.

What cannot hold a certificate stays on MAB

Sensors, legacy equipment, and anything without a usable certificate store or supplicant keep authenticating by MAC address in your NAC, on a restricted VLAN or a separate wired or wireless design, as your network team decides. Smallstep RADIUS is EAP-TLS only and has no MAB, so for these devices keep ClearPass, ISE, or your existing RADIUS in front of them. Certificates raise the bar for the devices that can use one; MAB stays the fallback, not the default.

Lifecycle matched to each device class

Agent certificates are short-lived and renew themselves. Managed devices renew on the MDM's schedule through a new challenge. Hand-loaded certificates run longer, with expiry visible and revocation available on authorities with active revocation, enforced only where the relying party checks it. Removing a device from inventory stops issuance through the paths that enforce it; a hand-loaded certificate has to be revoked.

Your NAC owns network admission and VLAN assignment. Smallstep owns which devices get a certificate and how it is tracked.

Key benefits for mixed device fleets

Inventory for enrolled devices, a catalogue for every certificate

Agent and MDM-enrolled devices appear in inventory with their enrollment method. Every certificate issued, hand-loaded ones included, is catalogued in Certificate Manager with its expiry.

Attestation where hardware allows

TPM 2.0 attestation on embedded Linux through the agent. Other device classes get inventory-gated issuance without hardware proof, and the page says so for each.

Fewer shared secrets

Per-device SCEP challenges replace the one password every printer knew. That reduces unauthorized enrollment, though it does not guarantee a profile cannot be reused and is not proof of hardware.

Your NAC stays in charge

ClearPass, ISE, or your RADIUS keeps MAB, VLAN assignment, and policy. Smallstep adds certificates to the devices that can use them.

Same SSID as laptops, where supported

Devices with a working supplicant authenticate with EAP-TLS on the corporate SSID and can be steered to a VLAN by certificate attribute on Enterprise RADIUS or your NAC. MAB devices keep the access design your network team sets.

Lifecycle you can see

Expiry per certificate, including the hand-loaded ones, so teams can plan renewal before a printer certificate expires. Renewal is automatic only where an agent or MDM drives it.

Give every device that can hold a certificate one, and know which ones cannot.

Send us your device list. We will map each class to its enrollment path, its assurance level, and what stays on MAB.

Book a demo

FAQs Smallstep for printers and IoT

Any device that can hold a client certificate and present it: an 802.1X supplicant for EAP-TLS, or an mTLS client. A certificate store for the admin web page alone is not enough. The path depends on the device: the Smallstep agent for Linux devices with a TPM 2.0; Dynamic SCEP for devices enrolled in a management tool that supports it; a CSR signed against a Smallstep authority and loaded by hand for devices with only a web interface. Devices with no certificate store at all stay on MAB in your NAC. Tell us what the device is, whether it has a TPM, whether it supports EAP-TLS, and what enrollment it supports, and we will map it.

Yes, if its management tool has a supported Dynamic SCEP integration with Smallstep. Each device gets a single-use challenge and its own inventory record. Which printer management platforms are validated is a question for the demo; not every tool can request and associate challenges. Printers that only support a static challenge password typed into the device cannot use this workflow, which does not offer static shared-challenge SCEP; for those, load a signed certificate through the printer's interface instead.

No. Smallstep RADIUS authenticates with EAP-TLS only, with no MAB, PEAP, accounting, or CoA. Keep your NAC or existing RADIUS for devices that authenticate by MAC address, and point it at the Smallstep CA for the devices that have certificates. See the NAC and RADIUS page for the keep, hybrid, and replace options.

Agent on Linux with a hardware TPM: the key is generated in the TPM and the device proves it through attestation against the endorsement key in inventory. Managed devices on Dynamic SCEP: issuance is gated on inventory and a single-use challenge, with no proof of hardware; a copied certificate and key, or a reused enrollment profile, could end up on another device. Hand-loaded certificates: the same, plus the key may have been generated outside the device. Relying parties can tell these apart by issuing authority or certificate attribute; use separate authorities or attributes where policy must depend on assurance.

Generate a CSR on the device if it can, download it, sign it with the step CLI against a Smallstep authority using a one-time token, and upload the certificate and chain through the device's interface. If the device cannot generate a key, create one with the step CLI, package certificate and key as PKCS#12, and import it; record that the key was created off-device. The certificate appears in Certificate Manager with its expiry; registering the device in inventory by API is separate, and linking the two is not automatic, so keep your own record of which certificate belongs to which device. Confirm supported key types, file formats, and EAP-TLS support with the device vendor first; some older firmware accepts only RSA.

Manually, which is why their lifetime should follow your maintenance cycle rather than the short lifetimes agents use, while staying short enough that a lost or retired device does not keep a valid credential for years. Certificate Manager shows expiry per certificate and can notify ahead of it. If a device supports SCEP renewal under management, use that instead so renewal is driven by the MDM.

If they run a supported Linux distribution on amd64 or arm64 with a TPM 2.0, systemd, and connectivity to Smallstep, they enroll through the agent with attestation and can receive mTLS and SSH credentials for talking to your cloud and for remote access, once those services are configured to trust the Smallstep authority. Without a TPM, the agent can still run against a software TPM, without attestation, or the device takes a loaded certificate. Real-time operating systems and microcontrollers are out of scope for the agent.

For agent and MDM-enrolled devices, remove it from inventory and further issuance through those paths stops. For any device, the existing certificate stays valid until expiry unless you revoke it on an authority with active revocation, and revocation only blocks access where the RADIUS or service checks CRL or OCSP; Smallstep RADIUS checks revocation on each authentication but has no Change of Authorization, so a session already established continues until the device reauthenticates or your network equipment ends it. Hand-loaded certificates have no inventory gate, so revocation is the control. For MAB devices, remove the MAC in your NAC as today.

The device. Headless devices have no assigned user, so the certificate carries a device identifier such as the serial number, a registered name, or another attribute you configure. For agent and supported MDM enrollment that identifier is tied to the Smallstep inventory record; for hand-loaded certificates you establish and maintain the association yourself. Write RADIUS and VLAN policy around that identifier, not around a username.

That is the usual order. Start with the devices that can attest, then managed devices on Dynamic SCEP, then the hand-loaded class where the device warrants it. MAB stays for what is left, on a restricted VLAN, and shrinks as devices are replaced with ones that can hold a certificate.

Not today. Mobile enrollment is MDM-driven by design: Apple does not allow apps to perform device attestation, and MDM payloads already cover Wi-Fi, VPN, and Safari. Mobile app support for other use cases is under development; ask us about current status for your case.

Yes. One inventory, one set of authorities, and one policy model apply across macOS, Windows, Linux, ChromeOS, iOS, iPadOS, and Android; what differs per platform is the enrollment method and the assurance it provides. RADIUS and VPN services validate the certificates and enforce their configured access policies. Where access must depend on assurance level, use distinct issuing authorities or trustworthy certificate attributes that identify the enrollment method and its verified assurance.

The posture certificate is what Client Connector evaluates; ZPA does not use it to authenticate the application session, which continues through your identity provider and ZPA policy. If you also use Smallstep certificates for browser mTLS to an application, that is a separate credential profile with its own store and issuer. Decide which path each resource uses and configure the profile for it.

Smallstep can extend device identity beyond Zscaler to supported Wi-Fi, VPN, SSO, SSH, and internal application integrations. Each needs its own credential configuration and enforcement on the resource side; for example, Smallstep can act as an additional device identity factor in supported Okta or Entra sign-in flows.