Certificates (CA and non-CA) can be loaded onto devices.
In addition, the device can generate a certificate to validate itself (device signature)....