Methods and devices are provided for generating, delegating, and/or authenticating hierarchical globally unique identifier (HGUID) certificates that are arranged in domain-name form to permit delegation and authentication as a Fully Qualified Domain Name (FQDN). A first hierarchical device certificate is obtained that includes at least part of a first unique device identifier for a first device and a base domain name, wherein the first hierarchical device certificate includes a fully qualified domain name and the first unique device identifier includes at least one of a type/model identifier or an origin/manufacturer of the first device. The first hierarchical device certificate is sent to an authenticating device to prove the first device has authority to perform a transaction within a restricted domain as defined by the first hierarchical device certificate. An indication may then be received from the authenticating device that the first device has been authenticated to perform the transaction.