[thayne]

Another option is you could use dynamic DNS on subdomains you control for the devices, then use ACME to provision certificates for those subdomains, and then have the DVR devices fetch the certificate for itself over a secure and authenticated channel.

> The device must be publicly accessible so the ACME server can reach it.

My understanding is that these devices are publicly accessible so that parents can access the DVR without being on the local network.