2 posts tagged architecture, newest first.
Certificates and mTLS are the easy part. The hard part is identity over a device's whole life: first enrolment, rotation, power loss mid-rotation, and a gateway that was offline for two years.
I built this blog to parse every post at compile time, wrote up why it was the right call, and then reversed it three weeks later. Both of my premises were false. Here is what replaced it, and how it keeps every property the compile-time version actually earned.