If you plan to use the device tunnel with Always On VPN again,
this would be for your domain joined devices, a certificate template
for the device certificate is going to be required.
That certificate is, of course, a machine certificate.
The only required EKU for this certificate, again,
is Client Authentication. And in this case, the subject name
is the host name of the device itself.
And much like the user certificate,
we want to ensure that this is enrolled to a TPM only, and again,
handle any cases where you can't enroll a device TPM as an exception. So let's take a look at deploying a device certificate template.