Derived certificate based on changing identity

A non-transitory computer-readable medium storing instructions for enabling a certificate authority service, and when the instructions are executed by a processor of a first device, cause the processor to:

• create for the first device a root certificate binding an identity of the first device to a long-term public key of the first device, the root certificate indicating that the root certificate is available for verifying digital signatures of derived certificates, wherein the root certificate is digitally signed using a long-term private key of the first device;
• generate a short-term public/private key pair consisting of a short-term public key of the first device and a short-term private key of the first device;
• and
• create for the first device a derived certificate binding at least one of one or more short-term identities acquired by a network module of the first device to the short-term public key of the first device, wherein the one or more short-term identities comprise one or more network addresses, and wherein the derived certificate is digitally signed using the long-term private key of the first device;
• and
• wherein the computer-readable medium further stores code which, when executed by the processor, causes the first device to:
• make the root certificate available to a second device in any trusted manner via any one of one or more communication interfaces of the first device;
• and
• send the derived certificate to the second device via any one of the one or more communication interfaces.