[VoiceOps] Preventing unauthorized access to SIP device config files

For providers that have centralized SIP device management that is available on the internet how have you been protecting your configurations from unauthorized access over https? Are there any specific measures that you found most helpful? I am assuming that certificate authentication is probably the best option. For people that are doing this, are you using the factory installed certs from the hardware provider or installing your own certificates on the devices? Are there any lessons learned on using certs that you can share? Thanks