// client:
cert = read_cert("server_cert.public_key");
connection = connect_ssl("https://server");
if ( !connection.check_public_key(cert) ){
	exit();
}

challenge = connection.recv();

SN = read_device_sn()

connection.send({
	SN: SN,
	response: sha256(SN + read_device_guid() + challenge),
	command: whatever you want to send
});

// server:
connection = accept();

challenge = generate_secure_random_bytes()
connection.send(challenge);

request = JSON_parse(connection.recv());

SN = request.SN
response = request.response
guid = find_guid_for_SN_in_database(SN)

if ( sha256(SN + guid + challenge) != response ){
	connection.tell_them_to_fuck_off();
}

execute the command