You create a (self-signed) CA certificate, put its certificate as the client ca in your web server.

Then you can create certificates using this CA that get distributed to your devices, only devices that have a certificate signed by your CA are allowed to connect.