Enterprise Wi-Fi you can trust

Traditional enterprise Wi-Fi still relies heavily on EAP-PEAP or EAP-TTLS, where access is granted using passwords, shared secrets, MSCHAPv2, or profile-based credentials stored on the device. These models are inherently weak and exposed to evil-twin attacks, credential replay or theft, password phishing, certificate or profile copying, and outright device impersonation.

Smallstep removes passwords from Wi-Fi entirely by using hardware-backed, short-lived EAP-TLS certificates. Only trusted, attested devices can authenticate, eliminating reusable credentials and collapsing the Wi-Fi attack surface to cryptographically proven device identity.

EAP-TLS delivers true mutual authentication between the device and the RADIUS server, eliminating passwords and shared secrets entirely. It provides strong resistance to replay and impersonation attacks, robust server validation, fast roaming with low-latency reconnection, and full compatibility with WPA3-Enterprise and Suite-B 192-bit cryptography.

It is the gold standard for enterprise Wi-Fi security, but traditionally difficult to operate at scale. Smallstep removes that friction by automating certificate issuance, renewal, and revocation, making EAP-TLS simple, secure, and manageable across large device fleets.

Most certificate-based Wi-Fi deployments are built on brittle foundations: SCEP with static or weak challenge passwords, long-lived certificates that are hard to rotate, MDM-only provisioning with no hardware attestation, and manual CA and RADIUS management. These approaches recreate password risk with certificates and provide little real assurance that a device is genuine or uncompromised.

Smallstep replaces this model with true Zero Trust Wi-Fi. It introduces ACME Device Attestation using TPM, Secure Enclave, or Verified Access, enforces non-exportable private keys, issues short-lived Wi-Fi certificates measured in hours or days, and automates renewal based on compliance, inventory, and attestation state. RADIUS can be hosted or self-hosted and auto-configured for your CA, onboarding is zero-touch via MDM or agent, and revocation is immediate on posture or attestation failure. The result is Wi-Fi access rooted in cryptographic device identity, not fragile provisioning workflows.

Before issuing a Wi-Fi certificate, Smallstep verifies the device, not just the request. It requires hardware attestation from a TPM, Secure Enclave, or Verified Access, confirms the device is in your inventory as synced from Jamf, Intune, Workspace ONE, Google Workspace for ChromeOS, or the API, and confirms the private key was generated inside a secure element and cannot be exported. If any of these fail, the certificate is neither issued nor renewed.

Posture is enforced at the connection. Enterprise RADIUS can call your webhook on every EAP-TLS authentication, so a signal from your EDR or MDM, such as an Intune compliance state or a CrowdStrike risk score, can deny access on the spot rather than waiting for a certificate to expire. Smallstep provides the hook; your team connects the posture source.

This blocks MAC address spoofing, profile copying, VM cloning, and stolen or unmanaged laptops from joining the network. Only devices that can cryptographically prove their identity are allowed to authenticate.

Enterprise Wi-Fi relies on a RADIUS server to validate EAP-TLS client certificates, and operating that infrastructure is often where deployments stall. Smallstep’s hosted RADIUS removes that burden entirely.

It automatically trusts your Step CA or Device CA, requires no on-prem hardware or cluster management, supports all major access point platforms including UniFi, Aruba, Cisco, and Meraki, scales globally with a highly available architecture, and enforces device identity and revocation automatically. Organizations simply point their AP controller to the provided RADIUS host, port, and shared secret and Wi-Fi authentication is immediately governed by cryptographic device trust.

Yes. Smallstep fully supports WPA3-Enterprise Suite-B 192-bit mode for environments with the highest security requirements. This includes EAP-TLS authentication, elliptic curve certificates using secp384r1, AES-256-GCM with SHA-384, and strict mutual authentication.

These capabilities are required in high-security government, defense, and regulated environments, and Smallstep enforces them without custom infrastructure or non-standard components.

Smallstep delivers consistent, hardware-backed Wi-Fi identity across all major platforms. On macOS, iOS, and iPadOS, certificates are provisioned through MDM profiles using Jamf, Iru, or Intune, with Apple Managed Device Attestation for supervised devices and automatic certificate issuance and renewal. On Windows, Intune integrates with ACME Device Attestation or dynamic SCEP to generate TPM-backed, non-exportable keys and install Wi-Fi profiles automatically.

On Linux, the Smallstep agent integrates with NetworkManager or wpa_supplicant, using TPM-backed keys via PKCS#11. On ChromeOS, Chrome Verified Access provides device attestation with policy-driven certificate deployment. Across all platforms, private keys are hardware-bound, certificates are short-lived, renewal requires successful attestation, and devices that fall out of trust stop connecting automatically.

Short-lived EAP-TLS certificates don’t just improve security—they reduce operational overhead. Authentication handshakes are faster, 802.11r fast transition is fully supported, and there’s no password hashing, PEAP negotiation, or captive portal delay in the connection path.

As a result, connection failures drop and helpdesk tickets decline. EAP-TLS generally outperforms PEAP and TTLS, and Smallstep makes the entire certificate lifecycle automatic and frictionless.

Yes. Because every device is issued a unique, cryptographically proven identity, RADIUS can enforce precise network controls such as VLAN assignment, ACLs, role-based segmentation, and device- or group-based access tiers.

Unlike MAC address–based segmentation, which is trivial to spoof, certificate-based identity provides strong, non-spoofable enforcement rooted in cryptography rather than network heuristics.

Smallstep combines short certificate lifetimes with strict renewal gating to make Wi-Fi access self-revoking. When a device is removed from inventory, renewal stops automatically. If hardware attestation breaks, new certificates are not issued. If you connect a posture source through the RADIUS webhook, a failed check denies the device at its next authentication, without waiting for the certificate to expire.

Administrators can also revoke certificates manually through dashboards or APIs, but in most cases that isn’t necessary. Devices lose Wi-Fi access on their own as soon as certificates expire or renewal conditions are no longer met, without manual cleanup or reactive intervention.

Yes—but with explicitly different assurance levels instead of forcing everything into a single trust model. Managed devices use hardware-attested EAP-TLS, while BYOD devices can be issued software-scoped certificates with restricted access, and guest networks remain isolated using PSKs or captive portals.

In practice, organizations typically operate two Wi-Fi networks: a high-assurance corporate network reserved for attested devices only, and a lower-assurance BYOD network that still uses certificates but without hardware attestation.

Smallstep integrates directly with the systems enterprises already run: MDM platforms like Jamf, Intune, Workspace ONE, and Mosyle for inventory and profile delivery, IdPs such as Okta, Entra, and Google for SSO with device trust, and posture sources such as Intune compliance state or your EDR through the RADIUS webhook.

A device is issued a Wi-Fi certificate only if it exists in inventory and attests its hardware identity. Posture is applied at authentication: Enterprise RADIUS calls your webhook on every EAP-TLS connection, so a failed check denies the device without waiting for its certificate to expire. Network access is granted through Zero Trust identity enforcement, not static network credentials.

Yes. With Step CA Pro and Run Anywhere, Smallstep supports environments that require full control and sovereignty over identity infrastructure. Organizations can deploy on-prem or sovereign CA roots, local attestation services, on-prem RADIUS clusters, fully offline or air-gapped environments, and HSM-backed key storage.

This deployment model is common in highly regulated and high-assurance sectors such as finance, healthcare, defense, government, and critical infrastructure, where cloud-only identity systems are not an option.