Embodiments of the present invention provide a framework for facilitating the deployment of management tunnels between management and managed devices. The tunnel may be initiated either from the management device or from the managed device. When the channel is first established, the credentials of the respective devices are verified. To this end, each of the devices may be pre-provisioned with unique identifier, as well as certificate assigned by a certificate authority together with associated private key. Upon initial setup of the tunnel, the identity of the management device may be provided by the administrator. Alternatively, the devices may be pre-configured by the manufacturer to participate in a web of trust, with each device capable to accept recommendations for an identity of the management server from the other member devices. Finally, a management device locator server may be provided to facilitate easy configuration.