A device, mobile operator, network, and a device controller can exchange messages for EAP-TLS authentication. The network can include an authentication server function (AUSF). A device and device controller can record both a device certificate and a device controller certificate. The device controller can receive a subscriber concealed identity (SUCI) for the device from the AUSF. The device controller can decrypt the SUCI and send the network the certificates with a device SUPI. The network can send at least a TLS ephemeral public key to the device controller. The device controller can generate a digital signature for at least the ephemeral public key with a private key for the device controller certificate. The AUSF can complete an EAP-TLS authentication with the device using at least (i) the device certificate for the device, (ii) the device controller certificate for the server, (iii) the digital signature, and (iv) the ephemeral public key.