Support Linux without policy exceptions

Linux fleets are typically held together with unmanaged SSH keys, static TLS certificates, manual OpenSSL workflows, weak or inconsistent CRL and OCSP setups, long-lived API keys or bearer tokens, per-host configuration drift, and ad hoc machine identities. These approaches do not scale and fundamentally break down in Zero Trust, hybrid, and multi-cloud environments.

Smallstep replaces this with a unified, automated identity model for Linux systems. It provides hardware-backed device identity using TPM 2.0, automated certificate issuance and renewal via ACME, short-lived SSH certificates, and mTLS identity for services and workloads. With OS-native integration through systemd, NetworkManager, NSS, and PAM, Linux systems gain consistent, cryptographically enforced identity without manual PKI operations.

The Smallstep Linux Agent runs as a lightweight background service that performs TPM-backed hardware attestation, requests short-lived device certificates, and continuously rotates them. It injects Wi-Fi, VPN, and mTLS certificates into system keychains, exposes PKCS#11 to browsers and CLI tools, and supports SSH certificate issuance for secure access.

By exposing local identity to service workloads, the agent cryptographically binds each Linux machine to the organization. Trust is established through hardware-backed identity rather than IP addresses, hostnames, or MAC addresses.

Smallstep uses TPM 2.0 to generate an Attestation Key inside the TPM, prove possession of manufacturer-signed Endorsement Key certificates, and produce cryptographic attestation evidence that verifies hardware provenance. This attestation is used to issue a hardware-bound attestation certificate and, in turn, short-lived device identity certificates.

Because the private keys never leave the TPM, devices cannot be cloned or impersonated. Identity is tied to the physical hardware itself, not to software state that can be copied or replayed.

Smallstep supports virtually all major Linux distributions, including Ubuntu, Debian, RHEL and its derivatives such as Rocky, Alma, and CentOS Stream, Fedora, SUSE and openSUSE, Arch-based systems through community support, and Kubernetes nodes running any distribution. It also works across cloud virtual machines with vTPM support in AWS, GCP, and Azure, as well as bare-metal servers equipped with physical TPMs.

Any Linux system with systemd and TPM 2.0 or vTPM support can use hardware-backed identity. This makes consistent, cryptographic device identity feasible across heterogeneous fleets without distribution-specific workarounds.

Traditional Linux SSH relies on unmanaged authorized_keys files, static user and host keypairs, stale keys left on disk, shared administrative accounts, and manual rotation, with no binding to a specific device. This model creates persistent access, poor visibility, and weak accountability that does not align with Zero Trust principles.

Smallstep SSH replaces static keys with short-lived SSH certificates issued via SSO, optionally bound to TPM-attested device identity. It supports ephemeral Linux users through NSS and PAM, automates the access lifecycle, and provides complete traceability from identity to device to certificate to session. SSH becomes controlled, ephemeral, and fully aligned with Zero Trust.

Yes. Smallstep supports mTLS for Linux-based services through ACME-based issuance for internal applications and autocert for continuous rotation without service restarts. Systemd pre and post hooks enable clean certificate reloads, and ready-to-use templates are available for NGINX, Envoy, HAProxy, Caddy, Redis, and Postgres, with PKCS#11 support for OpenSSL-based applications.

Kubernetes-native issuance via step-issuer and autocert extends the same model to clusters. Workloads receive short-lived certificates by default, enabling Zero Trust traffic enforcement within and across clusters and data centers without manual certificate operations.

Smallstep automates network access on Linux by configuring Wi-Fi through NetworkManager or wpa_supplicant, provisioning VPN certificates for strongSwan and NetworkManager IKEv2, and storing keys securely using TPM-backed protection. It issues short-lived mTLS credentials and gates renewal on posture and policy checks.

As a result, Linux systems authenticate to networks using hardware-bound, ephemeral credentials rather than passwords or static certificates. Network access becomes identity-driven, continuously validated, and resistant to credential theft or replay.

Yes. mTLS is a core use case for Smallstep. It provides ACME-based issuance for internal services, automatic certificate rotation without downtime, and policy-driven identity constraints using SPIFFE-like SANs and environment tags. These identities integrate cleanly with service meshes or lighter-weight mesh alternatives.

With this model, Linux workloads mutually authenticate to other services, databases, and internal APIs using short-lived, attested identities. Trust is enforced cryptographically on every connection rather than inferred from network location or static credentials.

The Smallstep Agent exposes a PKCS#11 provider over a local socket at $XDG_RUNTIME_DIR/step-agent/step-agent-pkcs11.sock. This interface allows applications to access cryptographic operations without ever exporting private keys, which remain protected by hardware such as TPMs.

Through PKCS#11, browsers like Chrome and Firefox can perform mTLS authentication, OpenSSL-based applications can use TPM-backed private keys, and CLI tools such as curl, git, and kubectl plug-ins can authenticate using mTLS. Custom applications can also consume hardware-protected keys transparently. PKCS#11 makes Linux device identity broadly usable across the application stack without special integrations.

The Zero Trust lifecycle enforces continuous protection by design. Certificates expire quickly, typically within hours or a day, and removing a device from inventory immediately stops renewal. If posture checks from MDM or EDR fail, certificate issuance is blocked, and any TPM reset breaks attestation and prevents future identity renewal.

Because private keys are hardware-bound and cannot be copied, compromised Linux servers or endpoints lose access within minutes. Trust decays automatically without relying on manual intervention or incident response cleanup.

Linux administrators can enforce Zero Trust consistently across the environment, including SSH using short-lived certificates and device identity, Wi-Fi via EAP-TLS, VPN access with IKEv2 and mTLS, and internal RPC or microservice communication secured by mTLS. This applies equally to service mesh and meshless architectures, Kubernetes nodes and workloads, and infrastructure APIs.

Administrative scripts, CI/CD jobs, and automation tools authenticate using the same identity controls. Every access path relies on continuous authentication and hardware-backed identity rather than static credentials or network trust.

Yes. With Step CA Pro and Run Anywhere, organizations can deploy certificate authority infrastructure on-premises, in sovereign clouds, or in fully air-gapped environments. This includes local attestation authorities, private RADIUS, VPN, and SSH servers, customer-managed HSMs, and offline certificate issuance workflows without reliance on external control planes.

This model is ideal for defense environments, industrial control systems, critical infrastructure, healthcare, and financial institutions where sovereignty, isolation, and full control over identity and cryptographic trust are mandatory.

Smallstep supports automated agent deployment, certificate provisioning for services, and the replacement of static SSH keys used by automation tools. CA policy and configuration are managed declaratively through Terraform, and ACME endpoints can be consumed directly inside provisioning and deployment pipelines.

Configuration management systems handle system setup and drift control, while Smallstep handles identity and trust. Provisioning tools deploy and configure infrastructure; Smallstep secures it with continuous, cryptographic identity.

Most organizations onboard Linux fleets in phases, starting with SSH rollout to replace static keys, then introducing TPM-backed device identity, modernizing Wi-Fi and VPN access, integrating mTLS for services, and finally extending identity to CI/CD and workload authentication.

Adoption moves quickly because the Smallstep agent is lightweight, TPM 2.0 is widely available across modern hardware and cloud VMs, and integrations rely on standard Linux components rather than custom or invasive tooling.