Register for part 2 of our Device Identity Webinar Series!

Your YubiKey is half the answer. The machine is the other half.

A YubiKey proves a key was born on a genuine YubiKey. It doesn’t say which machine that key is plugged into, or whose hands are on it. Smallstep answers the machine half, binding access for your admins and engineers to the laptop’s own secure element.

Book a demo
background gradientbackground texture
Enroll with hardware attestation
Non-exportable private keys
Paired with device identity
Short lifetimes, enforced at the CA
Cut off a lost key
One policy across every resource

A YubiKey attestation identifies the key. Not the machine.

PIV attestation is strong proof: the key was generated on the YubiKey and never imported, and the statement carries the serial number, the firmware version, and the PIN and touch policy set at generation. But it attests any genuine YubiKey, including one bought this morning, and it says nothing about the machine the key is in. Approving the key is a separate step.

  • Proves on-device key generation, not ownership
  • Attests any genuine YubiKey, not only yours
  • Nothing in the statement describes the host

Enrollment backed by hardware, not a shared secret

The YubiKey signs the ACME device-attest-01 challenge with a key it generated in hardware. Nothing enrolls on a static password or a SCEP challenge phrase anyone can copy.

The key proves a person. The laptop proves the machine.

A YubiKey travels between machines by design. A device credential is re-earned from that machine’s secure element and can’t be carried elsewhere. It also can’t tell you who is at the keyboard, which is why customers run both.

The lifecycle a security key does not manage

Hardware protects the key. It does not renew the certificate, rotate it, or retire it when someone leaves. Smallstep owns that lifecycle: short lifetimes, renewal gated on fresh attestation, and revocation that blocks a key from enrolling again. Laptop credentials renew unattended. YubiKey credentials re-attest on your schedule.

One device policy, every sensitive resource

The machine credential is what resources check. The same hardware-bound device identity anchors Wi-Fi and VPN with EAP-TLS, gates SSH and internal apps, and becomes a device factor at SSO login. Your YubiKey stays the user factor on top of it. One policy instead of six consoles that disagree.

For engineering teams, the same device credential carries hardware-bound SSH certificates for GitHub, so a YubiKey on an unenrolled laptop can’t push code.

Keep your YubiKeys. Add the layer they were never meant to be.

Attested enrollment, automated certificate lifecycle, and device identity, so resources that require both reject a lost key on a machine you have not approved.

Book a demo

FAQs Smallstep for YubiKey Deployments

No. YubiKey protects a private key in hardware and proves it. Smallstep is the certificate authority and control plane around that key: enrollment policy, inventory, renewal, revocation, and enforcement at the resources people actually connect to.

It proves the private key was generated on that YubiKey and cannot be exported. The attestation certificate also carries the firmware version, the serial number, the form factor, and the PIN and touch policy for the slot. If you import a key rather than generate it on the device, attestation fails.

Through the ACME device-attest-01 challenge using the step attestation format, which is designed for non-TPM devices that issue their own attestation certificates. Generate a key in a PIV slot, then request a certificate using the YubiKey serial number as the ACME identifier.

The same platform issues hardware-bound credentials using the TPM on Windows and Linux, the Secure Enclave on macOS, and Verified Access on ChromeOS. Macs and iOS devices on MDM device enrollment (Apple silicon, A11 or later) enroll through Apple’s Managed Device Attestation. Assurance varies by platform and application; Core Concepts lists it per browser and app.

Today, enrollment runs per key through the step CLI and KMS plugin, with serials authorized in CA policy. That suits a defined population of privileged users more than a whole-company rollout. Agent-side YubiKey handling, including self-service enrollment, is in active development. Tell us your key count and platform mix and we will tell you where it stands.

Because a YubiKey is designed to move. Its attestation proves the key was generated on a genuine YubiKey, but nothing in it describes the computer it is plugged into, so the same key works on an unmanaged laptop as easily as on yours. Device trust needs a second credential that cannot move: a key generated in the laptop’s own TPM or Secure Enclave and checked against your inventory before issuance. Require both at the resource and you get the right person on the right machine.

Remove the serial from the inventory and revoke the certificate. The device can no longer enroll or renew, resources that check revocation deny it immediately, and any short-lived credential already issued ages out on its own schedule rather than lingering for years.

The hardware-bound machine certificate. Certificate-based EAP-TLS replaces password methods like PEAP, MSCHAPv2, and pre-shared keys, and attested ACME enrollment replaces static SCEP challenges, so network access depends on a credential that cannot be typed, phished, or shared. Enrollment runs through MDM or the Smallstep agent, so the certificate lands in the OS store the supplicant already uses.

Yes. Device identity becomes an additional factor at SSO login alongside your identity provider, so a new sign-in requires both the right user and an attested device, which blocks sign-ins from unmanaged machines. A session token stolen after sign-in is still a bearer token; pair device identity with short sign-in frequency and token protection to shrink that window.

Platform-issued credentials renew automatically before expiry, and lifetimes are short by default, so a credential that escapes your control has a small window of usefulness instead of a multi-year one. YubiKey PIV slot certificates renew through the same ACME flow used at enrollment.

Yes. Smallstep complements the identity provider and the MDM rather than replacing either. Directory identity and device management context feed enrollment decisions and policy, and access is enforced with the certificate.

Yes. The platform is available as cloud SaaS or on-prem hosting for teams with data sovereignty, air-gap, or regulatory constraints. It is built on open-source step-ca.