The problem

Device trust based on a MAC address is not trust — MAC addresses are trivially spoofed. Certificate-based authentication is the real answer, and it fails in practice for an unglamorous reason: certificates expire, and nobody owns the calendar.

How we approach it

Certificate strategy designed for the whole lifecycle rather than the first issuance: templates, trust chains, enrolment for devices that cannot enrol themselves, and a rotation schedule with an owner. The design assumes staff turnover.

What the work covers

• x509 certificate-based host authentication
• Certificate lifecycle and rotation
• Trust chain and template design