MeshPKI

MeshPKI describes a family of designs and implementations for providing public key infrastructure in mesh networks. Aimed at dynamic, multi-node environments such as wireless or software-defined meshes, MeshPKI enables secure device authentication and encrypted communication across changing topologies without relying on a single fixed perimeter.

Key goals include distributed trust anchors, automated enrollment, short-lived certificates, scalable revocation, and resilience to node churn and offline operation.

Architecture commonly features one or more trust anchors that may be distributed or cross-signed; device enrollment agents or lightweight CA services on mesh nodes; a directory or registry for identities and certificates; and automated issuance and renewal protocols (ACME-like or custom).

Operation includes device enrollment, certificate provisioning, mutual TLS between mesh peers, periodic renewal, and revocation handling, with attention to network latency, churn, and offline devices.

Typical use cases include community or enterprise wireless mesh networks, industrial IoT in distributed environments, disaster-response networks, and autonomous vehicle or drone mesh systems.

Security considerations address key compromise, certificate revocation latency, node compromise, supply-chain integrity of enrollment agents, and governance of trust domains; mitigation includes key rotation, short certificate lifetimes, offline trusted anchors, and auditable logs.

It relies on standard PKI primitives such as X.509 certificates, TLS and mTLS; interoperability is pursued through adherence to existing protocols where feasible.