Edit: seems like I was quite hasty when typing in my question at first, so here is an updated version of it.
I am developing an application that runs on PCs which are on the same LAN as other devices. I want to connect to these devices. Since the data communicated between the PC and the devices is sensitive, I want to protect it with encryption, authentication and integrity. Therefore I am using TLS.
The idea is that if someone manages to get access to the LAN from outside (somehow) he should not be able to use the data sent between a PC and a device (because of encryption). Also if someone gets access to the LAN from within he should not be able to just connect to any of the devices. There is currently no real user/password protection on the devices so I need some other sort of authentication. I was thinking of certificates here. The idea is as follows:
The company which is running the LAN represents the Certificate Authority. There is a general server certificate which is stored on the devices. There is also a client certificate which is held private on the PC's that should be allowed to connect to the devices (like service notebooks, for example). The company signs both of those certificates.
Now, if someone is able to get access to the LAN, he might be able to sniff out any traffic, but it's encrypted so he cannot use the data. Moreover, if he wants to connect to any device, the connection will be refused since he is not in possession of the appropriate client certificate. However, clients can check if the devices they are connecting to are really those devices and not some intruder.
My question is: is this the right certificate infrastructure? Is this effective? Are the certificates sent via encryption or will they be sent unencrypted? If they are sent unencrypted, does this even have any use? I guess an intruder can just log the certificate sent by the client and then hold it on his own machine.