Wildcard-free certificates for network address domains

A system comprising:

• at least one processor;
• and
• a computer-readable storage medium storing instructions that are executable by the at least one processor to perform operations comprising:
• generating a graph that defines relationships between a network address and at least one domain, the graph comprising a plurality of nodes that each represent a corresponding domain of the at least one domain or the network address;
• generating a first certificate for the network address using the graph, the first certificate listing each of the plurality of nodes in the graph that identify corresponding ones of the at least one domain as separate certificate entries;
• responsive to a change to a relationship between the network address and the at least one domain, generating a modified graph based on the change to the relationship between the network address and the at least one domain;
• and
• generating a second certificate for the network address using the modified graph, the second certificate listing individual nodes in the modified graph as separate certificate entries.

A method comprising:

• receiving, at an access point, a certificate generated from a graph that defines relationships between the access point and a plurality of domains, each of the plurality of domains being represented as a separate node in the graph and being listed in the certificate as a separate certificate entry;
• receiving, from a device, a request to access data via at least one of the plurality of domains;
• and
• responsive to authenticating the device using the certificate, controlling data transfer between the at least one of the plurality of domains and the device based on the relationships between the access point and the at least one of the plurality of domains.