Secure VPN access from trusted devices

Legacy VPN solutions still depend on fragile authentication methods such as usernames and passwords, pre-shared keys, static long-lived certificates, replay-prone SCEP enrollment, and weak EAP mechanisms like MSCHAPv2. These approaches make VPN access vulnerable to credential theft, device impersonation, replay attacks, and easy lateral movement once an attacker gets inside the network.

Smallstep replaces these mechanisms with short-lived, hardware-attested certificates issued only to devices verified through TPM, Secure Enclave, or vTPM. VPN authentication is enforced using IKEv2 or mTLS, ensuring that only cryptographically proven, compliant devices are allowed to connect.

IKEv2 with certificate-based authentication is the most secure and scalable VPN option available across all major operating systems. It delivers fast connection and roaming, uses strong cryptography without MSCHAPv2, supports hardware-backed keys natively, and remains stable across Wi-Fi, LTE, and mobile networks on Windows, macOS, iOS, Android, and Linux.

Smallstep removes the operational pain from this model by automating certificate issuance and renewal and binding VPN access to hardware-backed device identity. VPN security becomes both stronger and easier to operate at scale.

Smallstep requires hardware attestation before issuing VPN certificates. The device generates a non-exportable key in the TPM or Secure Enclave, proves its hardware provenance through ACME Device Attestation, and is checked against inventory and posture requirements before any certificate is granted.

Only after those checks does Smallstep issue a short-lived VPN certificate. This blocks unmanaged devices from joining the VPN, prevents stolen VPN profiles from being reused, stops cloned VMs from tunneling into the network, and eliminates password or token replay. A VPN tunnel can be established only from a known, attested device.

VPN certificates are issued through native, automated workflows rather than manual setup. Smallstep supports issuance via the Smallstep agent on Windows, macOS, and Linux, through MDM workflows in Intune, Jamf, and Workspace ONE, and via Chrome Verified Access on ChromeOS, all backed by ACME Device Attestation to ensure hardware-bound private keys.

The resulting certificates are non-exportable, rotate automatically, and require re-attestation for renewal. They are installed directly into the operating system’s native VPN client with no user interaction required.

No. Smallstep does not replace your VPN gateway. It manages identity and the certificate lifecycle. The VPN infrastructure itself stays exactly where it is.

Smallstep integrates with platforms like strongSwan, AWS Client VPN, Azure VPN Gateway, GCP Cloud VPN, Palo Alto GlobalProtect in certificate mode, Fortinet, Cisco ASA and FTD, Juniper SRX, and any VPN appliance that supports IKEv2 or mTLS. You keep your existing VPN provider. Smallstep upgrades how authentication works.

Smallstep VPN removes the most common sources of VPN compromise. There are no passwords, which eliminates phishing, weak secrets, and brute-force attacks. There are no pre-shared keys to distribute or leak. Certificates are bound to hardware, so they cannot be copied to another device, and short lifetimes ensure compromised devices lose access quickly.

Access is maintained only while the device remains trusted. Hardware attestation and posture validation are required, and every certificate renewal re-checks trust instead of relying on a one-time login. This enforces a continuous Zero Trust model rather than a static connection.

Smallstep relies on short-lived, automatically rotated certificates to make revocation immediate and reliable. Access is revoked when a device is removed from inventory, when MDM or EDR reports a posture failure, when the TPM or Secure Enclave state changes, or when an administrator explicitly revokes access.

Because certificates expire within hours or less, revocation takes effect automatically and globally without manual cleanup. For environments that require active revocation signaling, Step CA Pro can also expose OCSP responders, CRLs, and distributed revocation logs.

Yes. VPN access can be governed by explicit policy rather than broad network trust. Policies can restrict which users are allowed, which devices may authenticate, and which user–device combinations are valid, along with requirements such as minimum OS version, disk encryption state, or EDR compliance.

This also enables clean segmentation for contractors or BYOD devices and allows per-application or per-network privileges instead of blanket access. VPN connectivity is aligned directly with Zero Trust identity and posture requirements.

From the end user’s perspective, VPN access becomes simpler rather than more complex. There are no password prompts, certificate renewal happens silently, and the operating system’s native VPN client is used with no custom applications required.

Connections remain stable as users move between Wi-Fi, LTE, home, and office networks, leading to fewer failures and support tickets. It feels like a passwordless VPN, but with far stronger cryptographic security under the hood.

Yes. Smallstep governs identity, while your VPN appliance or ZTNA components continue to handle routing. Identity and access decisions are decoupled from how traffic flows through the network.

This supports split tunnel and full tunnel configurations, application-specific routing, MASQUE or HTTP/3 ZTNA tunnels, and site-to-site hybrid setups. Identity becomes independent of network topology, allowing access controls to remain consistent even as routing models change.

Smallstep integrates directly with native cloud identity mechanisms, including AWS NitroTPM with Instance Identity Documents, GCP Instance Identity Tokens, Azure Managed Identity with vTPM, and Kubernetes workload identity. These signals provide strong, non-spoofable proof of where a workload or device is running.

This enables device-based VPN access for end users, workload-based VPN authentication, and secure gateway access for cloud-to-cloud or cloud-to-on-prem traffic. Cloud VPN entry points can require attested device or workload certificates, ensuring only verified identities are allowed to connect.

Security is preserved because trust is anchored in hardware and continuously enforced. Private keys cannot be exported, certificates expire quickly, and removing a device from inventory immediately prevents renewal.

If hardware is tampered with, attestation fails. If a user is suspended in the IdP, new certificates are no longer issued. A stolen device cannot be used to establish a VPN connection.

Yes. With Step CA Pro and Run Anywhere, organizations can deploy Smallstep entirely on their own infrastructure, including on-prem certificate authorities, on-prem attestation services, local VPN gateways, customer-managed HSMs, and even fully offline operation.

This deployment model is ideal for government, defense, financial institutions, critical infrastructure, and industrial environments where external control planes are not acceptable.

Smallstep works with a wide range of VPN servers, including strongSwan as the reference implementation, AWS Client VPN, Azure Virtual Network Gateway, GCP VPN, Palo Alto in certificate mode, Fortinet FortiGate, Cisco ASA and FTD, and Juniper SRX.

On the client side, it supports native IKEv2 clients on Windows, macOS, and iOS, Linux via strongSwan and NetworkManager, ChromeOS certificate-based VPN, and Android IKEv2 clients with certificate support. Interoperability is strong because IKEv2 and mTLS are open, widely supported standards rather than proprietary protocols.