Automated certificate enrollment for devices in industrial control systems or other systems

An apparatus configured to provide a certification authority, the apparatus comprising:

• at least one processor configured to:
• receive, from a device, (i) a certificate request for the certification authority and (ii) a first digital certificate, wherein the certificate request is digitally signed by the first device and the first digital certificate is stored in the device;
• verify the first digital certificate using a second digital certificate of another certification authority;
• verify a digital signature of the certificate request using the first digital certificate;
• and
• after verifying the first digital certificate and the digital signature, initiate transmission of a second digital certificate to the device.

A method comprising:

• generating a key pair having first and second keys associated with a device;
• generating a certificate request associated with the key pair;
• digitally signing the certificate request;
• transmitting the certificate request and a first digital certificate stored in the device to a certification authority;
• and
• in response to the certification authority verifying the first digital certificate and a digital signature of the certificate request, receiving a second digital certificate from the certification authority and storing the second digital certificate in the device.

An apparatus comprising:

• at least one memory configured to store a first digital certificate;
• and
• at least one processor configured to:
• generate a key pair having first and second keys associated with the apparatus;
• generate a certificate request associated with the key pair;
• digitally sign the certificate request;
• initiate transmission of the certificate request and the first digital certificate to a certification authority;
• and
• in response to the certification authority verifying the first digital certificate and a digital signature of the certificate request, receive a second digital certificate from the certification authority and store the second digital certificate in the at least one memory.