Establishment of trust between connected network devices

A computer-implemented method comprising:

• storing, at a network device associated with a network fabric, a root certificate of a Public Key Infrastructure (PKI) service such that the network device is a trust anchor for the PKI service, wherein the network device is a Top-of-Rack (ToR) switch;
• determining that an end device has established a physical connection to a port of the network device;
• applying, to the port, a first access control list (ACL) defining first permissions that allow the end device to send traffic to foundation services associated with the network fabric;
• allowing, based at least in part on the first ACL, the end device to perform an attestation handshake with the PKI service that is included in the foundation services;
• receiving a digital certificate from the end device;
• authenticating, at the network device, the end device using the digital certificate and the root certificate;
• and
• in response to authenticating the end device, applying a second ACL policy to the port, wherein the second ACL defines second permissions that are more permissive than the first permissions.

One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• storing, at a network device in a network fabric, a root certificate such that the network device is a trust anchor for a certificate authority associated with the network fabric, wherein the network device is a Top-of-Rack (ToR) switch;
• detecting an end device that has established a physical connection to a port of the network device;
• applying, to the port, first network policies defining first rules for traffic sent from the end device;
• receiving first traffic sent from the end device and destined to the certificate authority;
• determining that the first network policies allow the first traffic to be sent from the end device and to the certificate authority;
• allowing the end device to perform an attestation handshake with the certificate authority;
• receiving a digital certificate from the end device;
• authenticating, at the network device, the end device using the digital certificate and the root certificate;
• and
• in response to authenticating the end device, applying second network policies to the port that define second rules for traffic sent from the end device.