Initial bootstrap of app

MUD Controller

SHG

App

SHG

(1)

(3)

User accepts

provisioning

instructions

(IP Tables)

MUD Supervisor

• HTTPS connection from app to SHG.
• NO PASSWORDS.
• TLS ClientCertificate (pinned in database, CA part irrelevant)
• TLS ServerCertificate:
• mud.nc0a8fc4.r.securehomegateway.ca

%dig +short mud.nc0a8fc4.router.securehomegateway.ca aaaa

fd2a:c0a:8fc4::18e

ULA

Generated by router

As per RFC7084

WebPKI certificate

Installed at factory

W/ DNS name

How do I bootstrap

The first Client Certificate?