Launching today

BastionXP

Launching today

Issue TPM/SE hardware-attested X.509 certificates to devices

2 followers

Issue TPM/SE hardware-attested X.509 certificates to devices

2 followers

Visit website

BastionXP is a cloud-native private PKI CA that performs ACME Device Attestation (hardware attestation + private key in TPM/SE/vTPM/HSM) before signing and issuing short-lived X.509 digital certificates to laptops, mobile devices, IoT, workloads using the ACME protocol. Secures access to your enterprise Wi-Fi, VPN, SaaS apps, MCP gateway/clients in your enterprise network using EAP-TLS and mTLS client authentication. Replaces the legacy SCEP protocol platforms that uses shared credentials.

Free

Launch tags:SaaS•Tech•Security

Launch Team

Tines The single, secure environment for agents, apps, and automations.

Promoted

Maker

📌

Hey Product Hunt! 👋 I'm Ganesh, founder of BastionXP — and I'm excited to finally share what we've been building. The problem that pushed us to build this: Every small and medium-sized organization we've worked with has the same dirty secret — Wi-Fi passwords written on whiteboards, VPN credentials shared over Slack or email, and SCEP servers running on decade-old configs that nobody wants to touch. When a device gets lost or an employee leaves, nobody really knows what's still authenticated where. The root cause? Legacy protocols like SCEP were designed for a world before cloud, before mobile, and before hardware security chips became standard in every laptop and phone. What BastionXP does: BastionXP is a cloud-native private CA and device identity management platform that issues hardware-attested certificates directly to devices — anchored to the TPM chip on Windows/Linux machines and the Secure Enclave on Macs and iPhones. Secure access to your Wi-Fi, VPN, and SaaS applications in your enterprise network. Replace legacy SCEP with automated ACME Device Attestation. No shared secrets. Zero credential theft. Every access request is cryptographically tied to a physical device you own. It plugs directly into your existing stack — Microsoft Entra ID, Okta, Intune, Jamf Pro — and automates the full certificate lifecycle via the ACME Device Attestation protocol. Your IT team doesn't change workflows; the security posture just becomes airtight. What makes us different: Zero shared secrets — nothing to phish, leak, or rotate manually Hardware-bound identity via TPM + Apple Secure Enclave Drop-in SCEP replacement with automated ACME Device Attestation Works across Wi-Fi (EAP-TLS), ZTNA-VPN, and SaaS apps from one platform We started with a simple belief: identity is only as secure as the hardware it lives on. Software-only credentials can be copied. Silicon can't. Try it free — no credit card, no sales call. https://www.bastionxp.com/trial We'd love your feedback, especially from IT and security folks who've battled SCEP or struggled with certificate management at scale. Happy to answer any questions below!

Report

3mo ago

Forum Threads

p/bastionxp

•

1d ago

Are you are still using legacy SCEP protocol to manage your device identity certificates?

SCEP relies on shared challenge passwords that are easily intercepted from MDMs or disgruntled staff. Once leaked, any rogue device can request a trusted certificate, leaving you unable to distinguish a corporate laptop from a hacker s virtual machine.
SCEP allows private keys to be generated in software, meaning they can be exported, cloned, and moved to unauthorized hardware. A single stolen SCEP-issued certificate opens your entire enterprise security perimeter to persistent, untraceable access.
SCEP lacks any mechanism to verify the TPM or Secure Enclave, simply assuming the device is legitimate. In an era of sophisticated device spoofing, this lack of hardware attestation is a guaranteed recipe for a major breach.

ACME Device Attestation addresses all these problems by offering a password-less device identity-aware network access with hardware-rooted security. Security is no longer based on what you know (the passwords) but what you own (the company approved device/hardware).

View all