Device identity: are your certificates actually bound to devices?

TL;DR: Most organisations still mistake certificates for device identity, but Smallstep argues that long-lived, manually issued, exportable credentials and ticket-based renewal leave Zero Trust enforcement porous. Strong device identity depends on unique, hardware-bound, short-lived credentials with automated lifecycle control, not compliance-visible certificate inventory.

Editorial analysis by NHI Mgmt Group, based on content published by Smallstep: “Your Device Identity Is Probably a Liability”.

Key questions

Q: What breaks when device identity is portable?

A: When a device credential can be copied or replayed, access logs still show a valid authentication while the original device may be absent.

Q: Why do long-lived device certificates create more risk than they remove?

A: Long-lived certificates extend the compromise window and make revocation less effective because attackers can keep using a valid credential long after the device changes state.

Q: How can security teams tell whether device identity is actually working?

A: The best signal is not perfect recognition, but stable performance across collision, division, and persistence scenarios.

Practitioner guidance

• Audit certificate portability Identify where device certificates live in exportable software keystores, shared volumes, or unmanaged renewal paths, then classify those cases as portable identity rather than trusted device identity.
• Bind keys to hardware Require TPM or secure enclave storage for private keys so credentials cannot be copied and replayed from another host.
• Shorten credential lifetimes Move device certificates from months or years to hours or days so compromise windows collapse quickly and expired credentials stop authorising access.

Bottom line: Device identity fails when certificates are portable, because a credential that can move away from the device can no longer prove the device is present.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →