Does Smallstep support certificate enrollment and device attestation?
Certificate authority · issuer perspective
Smallstep is a hosted certificate authority platform that issues device and client certificates through the Smallstep Agent and through MDM-delivered SCEP and ACME payloads. Its documentation covers Wi-Fi EAP-TLS, SSH, VPN and browser client certificates on macOS, Windows, Linux, iOS and ChromeOS devices.
Vendor
Smallstep
Published workflows
12
Verified
2026-10-29
Workflows selected by signed issuer ID; management platforms remain distinct · Evidence and conditions are shown per workflow
01
application authentication
3 workflows
Smallstep: application authentication workflows · signed issuer and managing platform shown separately
On Windows managed by Microsoft Intune (Windows), a application authentication certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Operating system
Windows
Certificate purpose
application authentication
Enrollment method
SCEP profile
Enrollment service
SCEP gateway
Issuer type
third-party CA
Key protection
depends on a documented setting
Attestation evidence
not documented by the vendor
Verification type
vendor documented
Prerequisites
Entra ID application with the Intune application permission scep_challenge_provider; client credentials added to Smallstep; Intune SCEP profile with key storage provider Enroll to Trusted Platform Module (TPM) KSP (if present), or Software KSP, Client Authentication EKU and the Smallstep SCEP server URL.
Notes and documented limits
Bootstrap credential only. The key storage provider setting falls back to a software KSP when no TPM is present, so key protection is depends. Renewal of the bootstrap certificate is not described on the page.
Evidence for wf-smallstep-intune-windows-agent-bootstrap-scep (6 claims)
A SCEP token is a single-use password used by devices to get a bootstrapping certificate from Smallstep.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune SCEP profile enrolls to the TPM KSP if present, otherwise the Software KSP.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP Server URL in the Intune profile is the URL shown by Smallstep.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Entra ID application is granted the Intune application permission scep_challenge_provider.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile selects Client Authentication among predefined extended key usages.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts describes the MDM SCEP payload certificate as the provisional identity the agent uses to bootstrap.
Windows 10 or later device managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token validated through the Entra ID application; issuer Smallstep Agents Authority (third-party CA).
On macOS managed by Microsoft Intune (macOS), a application authentication certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Operating system
macOS
Certificate purpose
application authentication
Enrollment method
SCEP profile
Enrollment service
SCEP gateway
Issuer type
third-party CA
Key protection
not documented by the vendor
Attestation evidence
not documented by the vendor
Verification type
vendor documented
Prerequisites
Entra ID application registered and client credentials added to Smallstep; Intune SCEP certificate profile for macOS with subject CN=step-agent-bootstrap, certificate type Device, key size 2048, SHA-2, root certificate Smallstep Agents Authority Intermediate, Client Authentication EKU, SCEP Server URL from Smallstep; certificate validity period 1 Year (default).
Notes and documented limits
Bootstrap credential only. The page defines the SCEP token as a single-use password used to get a certificate from Smallstep for bootstrapping. Key protection of the bootstrap key is not stated. Renewal of the bootstrap certificate is not described; the profile sets a 1 Year validity period.
Evidence for wf-smallstep-intune-macos-agent-bootstrap-scep (5 claims)
A SCEP token is a single-use password used by devices to get a bootstrapping certificate from Smallstep.
macOS computer managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication EKU, device certificate); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune SCEP profile uses CN=step-agent-bootstrap, certificate type Device, 2048-bit key, SHA-2 and the Smallstep Agents Authority Intermediate as root certificate.
vendor_documented Evidence status: supported
Certificate type: Device Subject name format: CN=step-agent-bootstrap Certificate validity period: 1 Year (default) Key size (bits): 2048 Hash algorithm: SHA-2 Root certificate: Select Smallstep Agents Authority IntermediateSmallstep documentation: Connect Microsoft Intune to Smallstep for macOS Tutorial; 5. Create configuration profiles in Intune
macOS computer managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication EKU, device certificate); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP Server URL in the Intune profile is the URL shown by Smallstep.
macOS computer managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication EKU, device certificate); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile selects Client Authentication as the extended key usage.
macOS computer managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication EKU, device certificate); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token; issuer Smallstep Agents Authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts describes the SCEP certificate issued via MDM as the provisional identity the agent uses to bootstrap.
macOS computer managed by Microsoft Intune; purpose provisional bootstrap identity for the Smallstep Agent (Client Authentication EKU, device certificate); enrollment method Intune SCEP certificate profile; enrollment service the Smallstep SCEP server URL with a single-use SCEP token; issuer Smallstep Agents Authority (third-party CA).
On macOS managed by Jamf Pro, a application authentication certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Operating system
macOS
Certificate purpose
application authentication
Enrollment method
SCEP profile
Enrollment service
SCEP gateway
Issuer type
third-party CA
Key protection
not documented by the vendor
Attestation evidence
not documented by the vendor
Verification type
vendor documented
Prerequisites
Jamf Pro connected to Smallstep; SCEP enrollment webhook configured in Jamf Pro; Smallstep-generated jamf-<connection-id>.mobileconfig uploaded to Jamf.
Notes and documented limits
Bootstrap credential only. Core Concepts describes the SCEP certificate issued via MDM as a provisional identity used to bootstrap with the Smallstep platform. Key protection and renewal of this bootstrap certificate are not stated on the Jamf page.
Evidence for wf-smallstep-jamf-macos-agent-bootstrap-scep (4 claims)
The downloaded profile is named jamf-<connection-id>.mobileconfig.
macOS computer managed by Jamf Pro; purpose provisional bootstrap identity for the Smallstep Agent (client authentication to Smallstep); enrollment method SCEP payload in the Smallstep-generated profile; enrollment service Smallstep SCEP endpoint with the SCEP enrollment webhook challenge; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP payload in the agent enrollment profile relies on the dynamic challenge served by the SCEP enrollment webhook.
vendor_documented Evidence status: supported
The SCEP payload relies on the dynamic challenge served by the SCEP enrollment webhook you configured earlier, so that webhook must be in place for enrollment to succeed.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Configure an agent enrollment profile
macOS computer managed by Jamf Pro; purpose provisional bootstrap identity for the Smallstep Agent (client authentication to Smallstep); enrollment method SCEP payload in the Smallstep-generated profile; enrollment service Smallstep SCEP endpoint with the SCEP enrollment webhook challenge; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Smallstep states it may use ACME or SCEP for certificate enrollment for compatibility reasons.
macOS computer managed by Jamf Pro; purpose provisional bootstrap identity for the Smallstep Agent (client authentication to Smallstep); enrollment method SCEP payload in the Smallstep-generated profile; enrollment service Smallstep SCEP endpoint with the SCEP enrollment webhook challenge; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts describes the SCEP certificate issued via MDM as the provisional identity the agent uses to bootstrap.
macOS computer managed by Jamf Pro; purpose provisional bootstrap identity for the Smallstep Agent (client authentication to Smallstep); enrollment method SCEP payload in the Smallstep-generated profile; enrollment service Smallstep SCEP endpoint with the SCEP enrollment webhook challenge; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Last materially updated
2026-10-29
Evidence last checked
2026-10-29
Verified on
2026-10-29
Verified by
Daniel Michan
02
Wi-Fi EAP-TLS
9 workflows
Smallstep: Wi-Fi EAP-TLS workflows · signed issuer and managing platform shown separately
On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Operating system
macOS
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
SCEP profile
Enrollment service
SCEP gateway
Issuer type
third-party CA
Key protection
not documented by the vendor
Attestation evidence
not documented by the vendor
Verification type
vendor documented
Prerequisites
Jamf Pro connected to Smallstep; SCEP Challenge webhook configured in Jamf with the SCEPChallenge event; device already enrolled with a basic Jamf MDM profile; Device or Computer Level profile, not User Level; no Jamf SCEP proxy needed because the hosted CA is reachable from the public internet.
Notes and documented limits
Agentless SCEP path. The page does not state key protection, attestation or renewal for the SCEP path; it contrasts SCEP with the ACME-DA path, whose key is hardware-bound. The older Jamf setup guide covers the same SCEP workflow.
Evidence for wf-smallstep-jamf-macos-wifi-scep (9 claims)
The Smallstep Agent is not required on the device in the Jamf SCEP path.
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Jamf deploys a profile that establishes CA trust, obtains a client certificate from the Smallstep SCEP server with dynamic single-use challenges, and configures Wi-Fi.
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
No Jamf SCEP proxy is needed because the Smallstep hosted CA is reachable from the public internet.
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
A SCEP Challenge webhook is added to the Jamf tenant configuration.
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP enrollment webhook lets Jamf request a dynamic, short-lived challenge string from Smallstep during the SCEP request.
vendor_documented Evidence status: supported
The SCEP Enrollment webhook allows Jamf to request a dynamic, short-lived challenge string from Smallstep during the SCEP request. The challenge string is injected into the SCEP payload for your clients to authenticate to Smallstep.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Configure a SCEP enrollment webhook in Jamf Pro
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The device should already be enrolled with a basic Jamf MDM profile.
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Jamf SCEP setup guide is for Device or Computer Level MDM profiles, not User Level profiles.
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The page contrasts the SCEP path with ACME-DA, where the private key is hardware-bound, and does not state key protection for the SCEP path.
macOS computer managed by Jamf Pro with a Device or Computer Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by ACME device-attestation payload through native MDM enrollment and issued by Smallstep: key protection Secure Enclave, attestation evidence device attestation verified by CA, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Operating system
macOS
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
ACME device-attestation payload
Enrollment service
native MDM enrollment
Issuer type
third-party CA
Key protection
Secure Enclave
Attestation evidence
device attestation
Verification type
vendor documented
Prerequisites
Jamf Pro connected to Smallstep with inventory sync; the Mac already synced into the Smallstep inventory, with a user assigned and approved; Computer Level configuration profile installed automatically; ACME Certificate payload with the device authority ACME-DA directory URL, Client identifier $SERIALNUMBER, Key Type ECSECPrimeRandom, Key Size 384, Hardware Bound True, Attest True; Core Concepts states ACME DA is only available to managed devices in Supervised mode. Apple: attestation is issued to Macs with Apple silicon; T2 Macs yield no attestation (Attest ignored); hardware-bound keys are EC 256 or 384.
Notes and documented limits
Documented in the Smallstep wireless networks tutorial, not on the Connect Jamf Pro page. The page says the key is hardware-bound and does not name the Secure Enclave; secure_enclave is inferred from Core Concepts. Renewal is not described on the page. The issued certificate does not appear in Keychain; the page points to mdmclient QueryCertificates.
Evidence for wf-smallstep-jamf-macos-wifi-acme-da (20 claims)
After installation the certificate Subject Common Name contains the serial number and the Hardware Bound property reads Yes.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts states Smallstep can be used on Apple platforms without the agent, with no bootstrapping, when the device is in inventory and marked trusted.
vendor_documented Evidence status: supported
On Apple platforms, Smallstep can be used without our agent software, with some limitations. For this workflow, there is no bootstrapping required. The device needs to be in the Smallstep inventory and marked as trusted before enrolling.Smallstep documentation: Platform Core Security Concepts Explained; Agentless MDM enrollment
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts describes device attested keys as proving a specific key is on a specific device, including proof of the serial number or other hardware identifier.
vendor_documented Evidence status: supported
This allows a third party to prove that a specific key is stored on a specific device or secure element. The device attestation includes cryptographic proof of the device’s serial number or other unique hardware identifier.Smallstep documentation: Platform Core Security Concepts Explained; Hardware bound keys
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Connect Jamf Pro page documents inventory sync from Jamf to Smallstep with a partial sync every hour and a full sync every 8 hours.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The device must have a user assigned and must be approved before it can obtain a certificate through ACME-DA.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Smallstep documents replacing SCEP with ACME Device Attestation on macOS with Jamf, with a hardware-bound private key and Apple attestation of the request origin.
vendor_documented Evidence status: supported
On macOS, you can replace SCEP with ACME Device Attestation (ACME-DA) for a higher-assurance workflow: the private key is hardware-bound, and Apple's attestation authority cryptographically proves the certificate request came from a specific, genuine Apple device.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation)
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In this path Jamf manages all settings and the Smallstep Agent is not involved.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The device must already be synced from Jamf into the Smallstep inventory because ACME-DA requests are checked against the serial number.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The ACME Certificate payload uses $SERIALNUMBER as Client identifier, Key Size 384, Key Type ECSECPrimeRandom, Hardware Bound True and Attest True.
vendor_documented Evidence status: supported
Set $SERIALNUMBER as the “Client identifier” Set 384 as the “Key Size” Select “ECSECPrimeRandom” as the “Key Type” Set “Hardware Bound” to “True” Set “Subject” to CN=$SERIALNUMBER Set “Extended Key Usage” to 1.3.6.1.5.5.7.3.2 Set “Attest” to “True”Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; macOS with Jamf Pro (ACME Device Attestation)
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The ACME directory URL field takes the device authority ACME-DA provisioner URL.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The profile is a Computer Level profile with Install automatically as the distribution method.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Network payload selects the ACME Certificate as the identity certificate with TLS as the accepted EAP type.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The issued certificate does not appear in the Keychain application and is inspected with mdmclient QueryCertificates.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts states that Apple limits hardware attestations to the Managed Device Attestation workflow using ACME DA, available only to managed devices in Supervised mode.
vendor_documented Evidence status: supported
For this reason, Apple limits hardware attestations to the Managed Device Attestation (MDA) workflow, using ACME DA, which is only available to managed devices in Supervised mode.Smallstep documentation: Platform Core Security Concepts Explained; Hardware bound keys
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the macOS (agentless) column.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The columns of that table are macOS (Smallstep agent), macOS (agentless), Windows, Linux and ChromeOS.
macOS computer managed by Jamf Pro and synced into the Smallstep inventory, with a user assigned and approved; purpose Wi-Fi EAP-TLS; enrollment method ACME Certificate payload with device attestation (ACME-DA); enrollment service the MDM payload itself, no Smallstep Agent; issuer Smallstep device authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that Attest set to TRUE requires HardwareBound set to TRUE.
macOS; Wi-Fi EAP-TLS; ACME certificate payload with Attest and Hardware Bound set true as the Smallstep tutorial specifies; Jamf Pro; Smallstep device authority ACME-DA provisioner
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that with HardwareBound the Secure Enclave generates the key pair and the private key is entangled with a system key.
macOS; Wi-Fi EAP-TLS; ACME certificate payload with Attest and Hardware Bound set true as the Smallstep tutorial specifies; Jamf Pro; Smallstep device authority ACME-DA provisioner
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple's developer hardware support table lists the Attest key as Ignored for T2 Macs, so a T2 Mac yields no attestation to the ACME server.
macOS; Wi-Fi EAP-TLS; ACME certificate payload with Attest and Hardware Bound set true as the Smallstep tutorial specifies; Jamf Pro; Smallstep device authority ACME-DA provisioner
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Apple documents that attestations are issued to Mac computers with Apple silicon.
macOS; Wi-Fi EAP-TLS; ACME certificate payload with Attest and Hardware Bound set true as the Smallstep tutorial specifies; Jamf Pro; Smallstep device authority ACME-DA provisioner
On iOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection not documented by the vendor, attestation evidence not documented by the vendor, renewal by not documented by the vendor, support status supported (vendor documented, verified 2026-10-29).
Operating system
iOS
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
SCEP profile
Enrollment service
SCEP gateway
Issuer type
third-party CA
Key protection
not documented by the vendor
Attestation evidence
not documented by the vendor
Verification type
vendor documented
Prerequisites
Jamf Pro connected to Smallstep; SCEP Challenge webhook with the SCEPChallenge event; device enrolled with a basic Jamf MDM profile; Device Level profile, not User Level.
Notes and documented limits
iOS is named only in the section heading macOS and iOS with Jamf Pro (SCEP); the body text does not single out iOS steps. The Smallstep Jamf pages do not document an ACME-DA path for iOS. Key protection, attestation and renewal are not stated for this path.
Evidence for wf-smallstep-jamf-ios-wifi-scep (4 claims)
The Jamf SCEP section heading names macOS and iOS, and the workflow obtains a client certificate from the Smallstep SCEP server with dynamic single-use challenges.
iOS device managed by Jamf Pro with a Device Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Smallstep Agent is not required on the device.
iOS device managed by Jamf Pro with a Device Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Jamf SCEP setup guide is for Device or Computer Level MDM profiles, not User Level profiles.
iOS device managed by Jamf Pro with a Device Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The page contrasts SCEP with the macOS ACME-DA path, where the private key is hardware-bound, and does not state key protection for the iOS SCEP path.
iOS device managed by Jamf Pro with a Device Level profile; purpose Wi-Fi EAP-TLS; enrollment method SCEP certificate payload; enrollment service Smallstep hosted SCEP server with a dynamic challenge webhook (no Smallstep Agent); issuer Smallstep authority (third-party CA).
On macOS managed by Jamf Pro, a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection Secure Enclave, attestation evidence depends on a documented setting verified by CA, renewal by agent, support status supported (vendor documented, verified 2026-10-29).
Operating system
macOS
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
agent enrollment
Enrollment service
agent
Issuer type
third-party CA
Key protection
Secure Enclave
Attestation evidence
depends on a documented setting
Verification type
vendor documented
Prerequisites
macOS 13 (Ventura) or later; Apple Silicon M1 or later; agent installed for a single user; Smallstep team with Pro features; Jamf Pro tenant with a package distribution point; SCEP enrollment webhook; agent enrollment profile downloaded from Smallstep (SCEP payload, CA certificates, agent settings, Login Items); agent reaches smallstep.com, api.smallstep.com, gateway.smallstep.com, control.infra.smallstep.com, *.[team-name].ca.smallstep.com, auth.smallstep.com, att.smallstep.com, tel.smallstep.com; Location permission for Wi-Fi management.
Notes and documented limits
Core Concepts labels the macOS agent Wi-Fi tier Smallstep attested: the agent emulates key attestation, the key is generated in the Secure Enclave, and the attestation certificate cannot prove the key is in a genuine Secure Enclave. That tier does not map onto the enum, so attestation_evidence is depends. Key protection fallback is optional per Core Concepts.
Evidence for wf-smallstep-jamf-macos-wifi-agent (14 claims)
The agent requires macOS 13 or later, Apple Silicon M1 or later, and single-user installation.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts states that on Apple platforms the agent emulates TPM remote key attestation and that this is not device attestation.
vendor_documented Evidence status: supported
To support some applications on Apple platforms, our agent can emulate TPM remote key attestation. We use a process similar to the Trusted Computing Group’s remote attestation process. This is not device attestation, however.Smallstep documentation: Platform Core Security Concepts Explained; Hardware bound keys
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Jamf integration deploys a Smallstep-generated configuration profile that enrolls devices using the Smallstep Agent.
vendor_documented Evidence status: supported
In this step, we’ll tie everything together by deploying a configuration profile that enrolls devices using the Smallstep Agent. Smallstep generates this profile for your Jamf connection, so you can download it from the Smallstep dashboard and upload it directly to Jamf Pro.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Configure an agent enrollment profile
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The downloaded profile bundles the SCEP payload, root and intermediate CA certificates, agent settings and the Login Items entry.
vendor_documented Evidence status: supported
The downloaded profile bundles everything required to enroll a device: the SCEP payload, your root and intermediate CA certificates, the Smallstep agent settings, and the Login Items entry for the agent.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Configure an agent enrollment profile
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Jamf integration requires a Smallstep team with Pro features, a Jamf Pro tenant and a package distribution point.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent can be installed via Jamf package distribution and policy or separately with another tool or scripts.
vendor_documented Evidence status: supported
There's two ways to install the agent: via Jamf (below): Use Jamf Pro's package distribution and policy management separately: Use a separate software management tool like Munki, or install the agent manually via scripts.Smallstep documentation: Integrate Jamf Pro with Smallstep Tutorial; Install the Smallstep agent
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Location permission is required when the agent manages Wi-Fi network configurations on macOS.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requests the client certificate with the private key generated in the device secure hardware.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent renews the certificate automatically before it expires and creates the EAP-TLS Wi-Fi profile.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads Smallstep attested for the macOS (Smallstep agent) column.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Smallstep attested workflow the private key is generated in the Secure Enclave and the public key is sent to the Smallstep attestation authority.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Smallstep attestation certificate attests possession of the private key but cannot prove the key is in a genuine Apple Secure Enclave.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts describes an optional hardware protection with fallback approach that uses the highest key protection level available.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The HARDWARE_ATTESTED credential setting generates the key in the TPM or Secure Enclave and requires remote attestation.
macOS 13 or later on Apple Silicon, managed by Jamf Pro, with the Smallstep Agent installed through a Jamf package and policy and enrolled through the Smallstep-generated profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
On macOS managed by Microsoft Intune (macOS), a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection Secure Enclave, attestation evidence depends on a documented setting verified by CA, renewal by agent, support status supported (vendor documented, verified 2026-10-29).
Operating system
macOS
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
agent enrollment
Enrollment service
agent
Issuer type
third-party CA
Key protection
Secure Enclave
Attestation evidence
depends on a documented setting
Verification type
vendor documented
Prerequisites
Smallstep team; Entra ID tenant with Global Administrator for tenant-wide API consent; Intune tenant with Intune Administrator; macOS configuration profiles created in Intune for agent settings and the SCEP bootstrap; agent installed through Intune macOS app deployment or a tool such as Munki; agent requirements macOS 13 or later, Apple Silicon M1 or later, single user.
Notes and documented limits
The Intune macOS page states no macOS version, Intune licensing or supervision requirement; the agent page supplies the OS requirement. Core Concepts labels macOS agent Wi-Fi Smallstep attested, so attestation_evidence is depends. No ACME payload path for Intune-managed Macs is documented on the Intune macOS page or the wireless tutorial.
Evidence for wf-smallstep-intune-macos-wifi-agent (10 claims)
Smallstep integrates with Intune to sync inventory, exchange SCEP tokens and enroll macOS endpoints with the Smallstep Agent.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts states the Smallstep attested process is not device attestation.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The integration requires an Entra ID tenant with a Global Administrator for API consent and an Intune tenant with an Intune Administrator.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune configuration profiles configure the agent settings; agent installation follows the Smallstep Agent Installation Guide.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent can be deployed with Intune macOS app deployment or another tool such as Munki.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune macOS page lists only a test macOS device among prerequisites and states no macOS version, licensing or supervision requirement.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires macOS 13 or later, Apple Silicon M1 or later, and single-user installation.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requests the client certificate with the private key generated in the device secure hardware and renews it automatically.
vendor_documented Evidence status: supported
Request a client certificate, generating the private key in the device's secure hardware. Install the RADIUS server CA as trusted for this network. Create the Wi-Fi network profile (SSID, WPA-Enterprise, EAP-TLS) on the device. Renew the certificate automatically before it expires.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Agent-managed clients
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads Smallstep attested for the macOS (Smallstep agent) column.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Smallstep attested workflow the private key is generated in the Secure Enclave; the attestation certificate cannot prove the key is in a genuine Secure Enclave.
macOS 13 or later on Apple Silicon managed by Microsoft Intune, with the Smallstep Agent deployed through Intune app deployment or another tool and configured by Intune profiles; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection TPM, attestation evidence device attestation verified by CA, renewal by agent, support status partial (vendor documented, verified 2026-10-29).
Operating system
Windows
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
agent enrollment
Enrollment service
agent
Issuer type
third-party CA
Key protection
TPM
Attestation evidence
device attestation
Verification type
vendor documented
Prerequisites
Windows 10 (Anniversary Edition) or higher per the Intune page, Windows 10 or later per the agent page; Windows Home not supported; TPM 2.0; amd64 or arm64; administrator privileges for the agent to reach the TPM; Entra ID application with Global Administrator consent and Intune Administrator; agent added to Intune as a Win32 app; agent enrollment policy set and Intune SCEP policy; agent reaches the listed Smallstep domains including att.smallstep.com.
Notes and documented limits
Agent creates a TPM attestation key and completes an ACME device-attest-01 challenge against the Smallstep Attestation CA. CONFLICT PENDING: Core Concepts lists Windows Wi-Fi as device attested in its credentials table but its fallback note says only Smallstep attested keys are available for Enterprise Wi-Fi on Windows; release notes v0.68.0 and the wireless tutorial match the table. Partial until resolved.
Evidence for wf-smallstep-intune-windows-wifi-agent (19 claims)
Scoped devices receive a certificate and have the agent installed and running.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Windows the agent stores HARDWARE_ATTESTED credentials in the computer certificate store.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Agent release v0.69.2 refers to a bootstrap enrollment through ACME device attestation on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune Windows page states Windows 10 (Anniversary Edition) or higher is supported and Windows Home is not supported.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The integration requires a Global Administrator for tenant-wide API consent and an Intune Administrator.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent is added to Intune for distribution to devices.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
A Windows policy in Intune enrolls devices using the Smallstep Agent.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires Windows 10 or later (not Home editions), a TPM 2.0 and amd64 or arm64.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires privilege escalation to communicate with the TPM on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent page names Windows 10 or later and does not mention Windows Server.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
During bootstrapping the agent creates an Attestation Key pair in the TPM and the Smallstep Attestation CA verifies the request comes from an inventoried device where the Endorsement Key is resident.
vendor_documented Evidence status: supported
The agent creates an Attestation Key pair in the TPM. The agent requests a device attestation certificate from Smallstep’s Attestation CA. The Attestation CA verifies that the request is coming from a device in your inventory where the Endorsement Key (EK) is resident.Smallstep documentation: Platform Core Security Concepts Explained; Device bootstrapping and enrollment
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent completes an ACME device-attest-01 challenge with the Attestation certificate, and the device certificate proves device identity and hardware binding of the key.
vendor_documented Evidence status: supported
The agent uses the Attestation certificate to complete an ACME device-attest-01 challenge from the Smallstep Agent CA to obtain a Smallstep device certificate. The device certificate cryptographically proves both the identity of the device and the hardware binding of the private key.Smallstep documentation: Platform Core Security Concepts Explained; Device bootstrapping and enrollment
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Windows devices with TPMs the attestable identifiers are the TPM Endorsement Key and a Platform Certificate.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Smallstep Agent can manage Windows Wi-Fi configurations end to end.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent generates the key in secure hardware, creates the EAP-TLS Wi-Fi profile and renews the certificate automatically.
vendor_documented Evidence status: supported
Request a client certificate, generating the private key in the device's secure hardware. Install the RADIUS server CA as trusted for this network. Create the Wi-Fi network profile (SSID, WPA-Enterprise, EAP-TLS) on the device. Renew the certificate automatically before it expires.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Agent-managed clients
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The HARDWARE_ATTESTED credential setting generates the key in the TPM or Secure Enclave and requires remote attestation.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Agent release v0.68.0 states that Windows Wi-Fi profiles using hardware-attested machine certificates now authenticate correctly.
vendor_documented Evidence status: supported
Windows Wi-Fi profiles that use hardware-attested machine certificates now authenticate correctly.Smallstep documentation: Release Notes; Smallstep Agent v0.68.0
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Core Concepts fallback note states that Windows has no native ACME Device Attestation support and only Smallstep attested keys are offered for Enterprise Wi-Fi on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Windows column.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Windows column.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Core Concepts fallback note states that Windows has no native ACME Device Attestation support and only Smallstep attested keys are offered for Enterprise Wi-Fi on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection TPM, attestation evidence device attestation verified by CA, renewal by agent, support status partial (vendor documented, verified 2026-10-29).
Operating system
Windows
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
agent enrollment
Enrollment service
agent
Issuer type
third-party CA
Key protection
TPM
Attestation evidence
device attestation
Verification type
vendor documented
Prerequisites
Same agent and Intune prerequisites as the agent-managed Wi-Fi record; a credential created in Smallstep with HARDWARE_ATTESTED key protection and authMode machine; an Intune OMA-URI Wi-Fi profile that selects the certificate by IssuerHash (SHA-1 of the issuing intermediate) and sets TrustedRootCA to the RADIUS server CA fingerprint.
Notes and documented limits
Variant: the agent-issued credential is consumed by an Intune-delivered Wi-Fi profile (OMA-URI) rather than an agent-managed profile. Same CONFLICT PENDING as the base record: Core Concepts table says device attested for Windows Wi-Fi, its fallback note says Smallstep attested only. Partial until resolved.
Evidence for wf-smallstep-intune-windows-wifi-agent-intune-profile (7 claims)
In the hybrid workflow the client certificate comes from the agent-managed credential and Intune deploys a Wi-Fi profile that selects it by issuer.
Windows 10 or later device with a TPM 2.0 managed by Microsoft Intune, where the Smallstep Agent manages the credential and Intune deploys the Wi-Fi profile through an OMA-URI profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
IssuerHash is the SHA-1 fingerprint of the issuing intermediate CA and TrustedRootCA is the SHA-1 fingerprint of the RADIUS server CA.
Windows 10 or later device with a TPM 2.0 managed by Microsoft Intune, where the Smallstep Agent manages the credential and Intune deploys the Wi-Fi profile through an OMA-URI profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Windows the agent stores HARDWARE_ATTESTED credentials in the computer certificate store, matched by authMode machine.
vendor_documented Evidence status: supported
on Windows, the agent stores credentials with HARDWARE_ATTESTED key protection in the computer certificate store (use machine, as in this guide's example), and credentials with all other protection levels in the user certificate store (use user).Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Windows with Intune (agent credential + OMA-URI profile)
Windows 10 or later device with a TPM 2.0 managed by Microsoft Intune, where the Smallstep Agent manages the credential and Intune deploys the Wi-Fi profile through an OMA-URI profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent completes an ACME device-attest-01 challenge and the device certificate proves device identity and hardware binding of the key.
vendor_documented Evidence status: supported
The agent uses the Attestation certificate to complete an ACME device-attest-01 challenge from the Smallstep Agent CA to obtain a Smallstep device certificate. The device certificate cryptographically proves both the identity of the device and the hardware binding of the private key.Smallstep documentation: Platform Core Security Concepts Explained; Device bootstrapping and enrollment
Windows 10 or later device with a TPM 2.0 managed by Microsoft Intune, where the Smallstep Agent manages the credential and Intune deploys the Wi-Fi profile through an OMA-URI profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires Windows 10 or later (not Home editions), a TPM 2.0 and amd64 or arm64.
Windows 10 or later device with a TPM 2.0 managed by Microsoft Intune, where the Smallstep Agent manages the credential and Intune deploys the Wi-Fi profile through an OMA-URI profile; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Windows column.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Core Concepts fallback note states that Windows has no native ACME Device Attestation support and only Smallstep attested keys are offered for Enterprise Wi-Fi on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Core Concepts fallback note states that Windows has no native ACME Device Attestation support and only Smallstep attested keys are offered for Enterprise Wi-Fi on Windows.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Windows column.
Windows 10 or later device (Windows Home not supported) with a TPM 2.0, managed by Microsoft Intune, with the Smallstep Agent distributed as an Intune Win32 app and enrolled through an Intune SCEP bootstrap certificate; purpose Wi-Fi EAP-TLS; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
On Windows managed by Microsoft Intune (Windows), a Wi-Fi EAP-TLS certificate enrolled by SCEP profile through SCEP gateway and issued by Smallstep: key protection depends on a documented setting, attestation evidence not documented by the vendor, renewal by MDM, support status supported (vendor documented, verified 2026-10-29).
Operating system
Windows
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
SCEP profile
Enrollment service
SCEP gateway
Issuer type
third-party CA
Key protection
depends on a documented setting
Attestation evidence
not documented by the vendor
Verification type
vendor documented
Prerequisites
Intune connected to Smallstep (Entra ID application that lets Smallstep validate SCEP enrollments); Automatic Enrollment enabled in Intune Windows enrollment; trusted certificate profiles for root and intermediate CA; SCEP profile with key storage provider Enroll to TPM KSP if available, Software KSP if not, Renewal Threshold 20%, 2048-bit key, SHA-2, Client Authentication EKU, root certificate set to the intermediate CA; Wi-Fi profile with EAP-TLS and SCEP Certificate authentication.
Notes and documented limits
Agentless path. Key protection is depends because the SCEP profile falls back to a software KSP when no TPM is available. Core Concepts places a Windows SCEP-based enrollment with Intune under the ACME-based MDM enrollment (agentless) heading; the figure itself is an image and was not readable.
Evidence for wf-smallstep-intune-windows-wifi-scep (11 claims)
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Intune deploys CA trust, a SCEP-issued client certificate and the Wi-Fi profile, and the Smallstep Agent is not required.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile enrolls to the TPM KSP if available and the Software KSP if not.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile sets a renewal threshold of 20 percent.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The SCEP profile validity period matches the duration configured in Smallstep.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The profile Root Certificate field is set to the intermediate CA because the SCEP client checks the intermediate fingerprint.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Intune connection tutorial registers the Entra ID application that lets Smallstep validate SCEP enrollments.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The page assumes Automatic Enrollment is enabled in the Intune Windows enrollment blade.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The Wi-Fi profile client authentication method is SCEP Certificate.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Core Concepts shows a Windows device doing a SCEP-based enrollment with Intune as an agentless MDM enrollment example.
Windows device managed by Microsoft Intune with Automatic Enrollment enabled, without the Smallstep Agent; purpose Wi-Fi EAP-TLS; enrollment method Intune SCEP certificate profile with a Wi-Fi profile; enrollment service the Smallstep SCEP server with challenges validated through the Entra ID application; issuer Smallstep (third-party CA).
Requirements, limitations and evidence 17 cited claims
Workflow reference: wf-smallstep-linux-wifi-agent
On Linux without a managing MDM, a Wi-Fi EAP-TLS certificate enrolled by agent enrollment through agent and issued by Smallstep: key protection TPM, attestation evidence device attestation verified by CA, renewal by agent, support status supported (vendor documented, verified 2026-10-29).
Operating system
Linux
Certificate purpose
Wi-Fi EAP-TLS
Enrollment method
agent enrollment
Enrollment service
agent
Issuer type
third-party CA
Key protection
TPM
Attestation evidence
device attestation
Verification type
vendor documented
Prerequisites
Enterprise Linux (RHEL, CentOS Stream, Rocky Linux, Alma Linux, etc), Ubuntu (Current Stable and LTS), Debian (Current Releases), Fedora (Current Releases) or NixOS; systemd-based service manager; TPM 2.0 module required; p11-kit and tpm-tss2; amd64 or arm64; running user with read/write access to the TPM resource manager (typically /dev/tpmrm0); device registered by step-agent register (admin approval required) or pre-registered via the Smallstep API with the TPM Endorsement Key URI; short-lived bootstrapping token when there is no MDM.
Notes and documented limits
Linux has no MDM in the Smallstep docs; devices enter inventory by self-registration or API. Keys are TPM-bound and non-exportable and are exposed to NetworkManager and wpa_supplicant over PKCS#11. Core Concepts labels Linux Wi-Fi device attested. A TPM access broker such as tpm2-abrmd is noted for multi-process TPM use.
Evidence for wf-smallstep-linux-wifi-agent (17 claims)
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Agent release v0.69.0 states both the Enterprise Linux 10 packages and the PKCS#11 engine are needed for Wi-Fi EAP-TLS to reach the agent keys.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent generates the key in secure hardware, creates the EAP-TLS Wi-Fi profile and renews the certificate automatically.
vendor_documented Evidence status: supported
Request a client certificate, generating the private key in the device's secure hardware. Install the RADIUS server CA as trusted for this network. Create the Wi-Fi network profile (SSID, WPA-Enterprise, EAP-TLS) on the device. Renew the certificate automatically before it expires.Smallstep documentation: Protect Wireless Networks with 802.1X EAP-TLS Certificates and Smallstep; Agent-managed clients
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent supports Enterprise Linux, Ubuntu, Debian, Fedora and NixOS.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent requires a systemd-based service manager on Linux.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The running user needs read/write access to the TPM resource manager because the agent talks to the TPM from user space with tpm-tss2.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Keys managed by the agent are bound to the TPM and cannot be exported; a PKCS#11 server exposes them to other software.
vendor_documented Evidence status: supported
Keys managed by the Smallstep agent are bound to the device's TPM and cannot be exported. To let other software use those keys for TLS handshakes and other purposes, the agent runs a PKCS#11 server, exposed as a UNIX socket at /run/step-agent/step-agent-pkcs11.sock.Smallstep documentation: Install the Smallstep Agent on macOS, Windows, and Linux; PKCS#11 support
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
PKCS#11 is the integration point for NetworkManager, wpa_supplicant, VPN clients and browsers.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Self-registration is not trust on first use and an admin must approve devices; the sentence sits in the NixOS registration section of the agent page.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
On Linux or without an MDM, a short-lived bootstrapping token serves as the provisional identity.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Devices not in MDM, including Linux endpoints, can be added to inventory through the Smallstep API and are marked approved for the agent.
vendor_documented Evidence status: supported
Admins can add devices that are not in MDM, including Linux endpoints, to your team's device inventory via the Smallstep API. Devices added via API will be marked as approved for use with the Smallstep agent.Smallstep documentation: Platform Core Security Concepts Explained; Bulk registration via API
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
For TPM 2.0 devices added via API the permanentIdentifier is the TPM Endorsement Key URI obtained with step agent tpm --fingerprint.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
The agent completes an ACME device-attest-01 challenge and the device certificate proves device identity and hardware binding of the key.
vendor_documented Evidence status: supported
The agent uses the Attestation certificate to complete an ACME device-attest-01 challenge from the Smallstep Agent CA to obtain a Smallstep device certificate. The device certificate cryptographically proves both the identity of the device and the hardware binding of the private key.Smallstep documentation: Platform Core Security Concepts Explained; Device bootstrapping and enrollment
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
In the Core Concepts key attestation level table, the Wi-Fi row reads device attested for the Linux column.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).
Last checked: 2026-10-29. Retrieved: 2026-10-29.
Agent release v0.68.0 states NetworkManager and wired 802.1X use PKCS#11 to access TPM-backed keys.
Linux device on Enterprise Linux, Ubuntu, Debian, Fedora or NixOS with systemd and a TPM 2.0, registered by self-registration or the Smallstep API, with the Smallstep Agent running; purpose Wi-Fi EAP-TLS through NetworkManager or wpa_supplicant over PKCS#11; enrollment method Smallstep Agent enrollment; enrollment service the Smallstep Agent; issuer Smallstep (third-party CA).