I am looking for best-practice advice for building a mutually-authenticated system using certificates. I would like to create a system with multiple IoT devices reporting data to a web server, in which both the server and client need to authenticate each other. I was thinking of using a root certificate authority (a personal one) and an intermediate certificate authority for the server certificate and another one for the client certificates.
Root CA signs intermediate CAs (x2), one signs server certs, one signs client certs.
In the future Root CA may sign another intermdetiate CAs.
Does this makes sense? Or is it better to implement separate root CAs for the server and the clients?
Since I am going to use self signed certs, in order one side to verify the other, do I have to provide root cert to all? or intermediate cert? What happens if one of the devices get compromised? (Revoking?)
Sorry for multiple questions but the follow up questions are related to the main question. How should the cert chain be designed? Which approaches are more secure?