I'm trying to implement mutual authentication for a TLS connection between a server (ONOS OpenFlow controller) and multiple clients (OpenFlow switches). I'm restricted in that I must create a single firmware image that will be pushed to the switches and the switches must not be manually configured after that.
Traditionally, one would set up a central authority and once the client created it's key pair the CA would sign it. As far as I understand, this is not possible with the restrictions because the signing process needs to be done manually.
Authentication of the server on the clients should not be a problem because the servers public key can be included in the firmware image.
Is it possible to achieve client authentication with these restrictions? Would it be an acceptable solution to distribute one single key pair to all clients in the firmware image?
Reference: OpenFlow specification - https://www.opennetworking.org/wp-content/uploads/2014/10/openflow-switch-v1.5.1.pdf#subsubsection.6.3.6