This could be extended to something like: Ship a USB stick with the device with installer software on it. The installer software sets up an SSH tunnel to the

This could be extended to something like: Ship a USB stick with the device with installer software on it. The installer software sets up an SSH tunnel to the device, so it includes an SSH client and a script (batch) file that effectively does: SSH -Llocalhost:<some random local port>:localhost:<installer initial port> setup@<ip address of device> It has the known SSH signature of the device in its known_hosts, and of course the user has to type the password from the sticker on the device. Then it fires up the browser with the url http://localhost:<local http://localhost:<local port used in previous step> which has access to the full setup of the device via the browser. It is HTTP, therefore there are no initial setup TLS issues with the browser, as you are going via an encrypted tunnel set up via SSH using HTTP encapsulated within that encrypted tunnel (effectively a temporary VPN) rather than using TLS. As part of the setup process, the device generates a self-signed cert, which you can put in your computers/browsers trusted cert store for future use. Also as part of the setup, once the self-signed keys and certs are generated, it disables this local HTTP webserver that is being forwarded to via SSH, so in future the user can use a standard TLS connection to the device using the generated certificates. If a factory reset of the device is done, it blats its config and re-enables the 'setup' webserver (that is only running on localhost therefore can only be access locally,i.e. via SSH tunneling).