Smallstep ZTNA

Smallstep Enterprise Relay is a transparent VPN for controlling device access to SaaS applications, internal networks, and AI-initiated workflows. It uses private MASQUE relays, mutual TLS, and hardware-bound device certificates. Administrators can direct selected domains through the relay with match and exclude rules, then enforce access through IP allow lists and mutual TLS. Network-level protection applies across the device, and approved traffic uses a dedicated outbound IP range. With a valid attested certificate, authentication takes place silently without login screens or prompts. The product supports Windows, macOS, Linux, and iOS; Apple devices can use the Managed Relay MDM payload on iOS 17+, iPadOS 17+, macOS 14+, and tvOS 17+. Windows and Linux use the Smallstep agent for hardware-bound mutual TLS authentication. Deployment can be in the cloud or on premises. Listed integrations include AWS, Stripe, Google Cloud Platform, Slack, Intune, Salesforce, GitHub, Okta, Jamf, and ServiceNow. Pricing is available by demo request, and there is no free plan.

Enterprise Relay pairs device certificates and traffic controls for organization-wide access management. Teams should assess its platform-specific setup and request a quote, since no price or free plan is listed.

It is aimed at security engineers, platform teams, CISOs, and enterprises seeking device-level Zero Trust enforcement. It may suit organizations needing access controls across the listed operating systems and cloud or on-premises deployment.

Smallstep ZTNA is a device-identity-based access service for routing approved traffic through private relays. It best suits security and platform teams that need organization-wide controls tied to managed devices. Its appeal is strong device-level enforcement; the trade-off is custom pricing and platform-specific deployment.

Overview

Smallstep Enterprise Relay works as a transparent VPN, using private MASQUE relays, mutual TLS and hardware-bound device certificates to control access to SaaS apps, internal networks and AI-initiated workflows. Administrators can direct selected domains through the relay, exclude others, and enforce access with IP allow lists and mutual TLS.

Network-level enforcement applies across the device, with approved traffic leaving through a dedicated outbound IP range. When a device has a valid attested certificate, authentication is silent: users do not need to respond to login screens or prompts. That can reduce friction while keeping access decisions tied to device identity.

Key features

• Traffic rules: Domain match and exclude rules let administrators decide which destinations use the relay. IP allow lists and mutual TLS add controls for services that need a narrower access boundary.
• Device identity: Hardware-bound certificates and mutual TLS underpin authentication. Smallstep says its CA signing keys are held in a hardware security module and that each HSM interaction is logged.
• Deployment choice: Smallstep says the service can run in the cloud or on premises, giving organizations a choice in where to deploy device-identity-based ZTNA.
• Security and integrations: The service uses end-to-end encryption, single sign-on and multiple layers of access control. Featured integrations include AWS, Stripe, Google Cloud Platform, Slack, Intune, Salesforce, GitHub, Okta, Jamf and ServiceNow.
• Administration: SSO/SCIM support, advanced admin controls, deployment automation, revocation workflows and CA integrations suit organizations managing device access as part of a broader identity program.

Pricing

Smallstep Enterprise Relay is a paid plan with custom pricing, provided through a demo request. Automatic renewal applies. There is no free plan, so teams should seek a quote before committing and confirm the renewal terms alongside the deployment scope.

The plan includes deployment automation, revocation workflows and CA integrations. That makes it relevant to teams that need to issue and manage device identities as part of access enforcement; there is no cheaper published tier or free allowance to evaluate first.

Platforms

Smallstep supports iOS, Linux, macOS and Windows, as well as self-hosted deployment. Apple devices use the Managed Relay MDM payload on iOS 17+, iPadOS 17+, macOS 14+ and tvOS 17+. Windows and Linux use the Smallstep agent for hardware-bound mutual TLS authentication. This split gives Apple fleets a native MDM route, while mixed Windows and Linux environments need the agent.

Who it's for

Security engineers, platform teams, CISOs and enterprises pursuing device-level Zero Trust enforcement are the clearest fit. The product is especially relevant where access needs to depend on device identity and where administrators want specific traffic routed through a controlled outbound IP range. Organizations looking for a consumer VPN, a free entry plan or a single uniform setup across operating systems should look elsewhere.

Pros and cons

• Pros: Device-wide enforcement and dedicated outbound IPs help organizations apply access rules beyond individual applications.
• Pros: Silent authentication with a valid attested certificate avoids repeated user prompts.
• Pros: Cloud or on-premises deployment, CA integrations and revocation workflows support enterprise identity operations.
• Cons: Custom pricing and no free plan make cost assessment dependent on a sales conversation.
• Cons: Apple deployments rely on specific MDM payload support and OS versions, while Windows and Linux require the Smallstep agent.

Alternatives

For organizations comparing certificate and identity tools, the right alternative depends on whether they need device-level traffic enforcement or certificate management itself.

• Entrust Certificate Manager is a paid certificate-management option for teams needing Android, iOS, Linux, self-hosted or web platform support; it has no free plan and pricing requires a conversation with Entrust.
• KeyTalk CKMS is worth considering for teams seeking an on-premises S/MIME plan with a free trial; its listed plan is €5 a month per user, for up to 250 participants.
• Microsoft Cloud PKI is a lower-cost fit for teams focused on certificate lifecycle management across Android, iOS, macOS and Windows: its plan is $2 a month billed yearly, with auto-renewal.

Readers comparing adjacent categories can also browse Certificate Management Software, Public Key Infrastructure Software and Business VPN Software.

Verdict

Smallstep ZTNA is a strong candidate for enterprises that want device identity to govern network-level access, with traffic rules, certificate-based authentication and cloud or on-premises deployment. Its main reason to choose is the combination of device-wide enforcement and silent authentication; its main reason to look elsewhere is the custom-priced, platform-specific setup, particularly for teams that need a free evaluation path or simpler deployment.