Provided in the present application are a certificate acquisition method and an authentication method and a network device, to improve the operation authority control of an API by an APP. According to the certificate acquisition method, the network device sends, to a certificate generation device, certificate application information comprising the APP, and the certificate generation device generates the certificate according to the APP, and sends the generated certificate to the network device. The certificate is used to authenticate the APP when the APP accesses an API of a controller. The certificate comprises one or more of the following (a) to (c): (a) authority information that the APP can operate the N application programming interfaces (API) of the controller; (b) the identifiers of L APIs, among N APIs, that the APP is authorized to operate; and (c) the identifiers of R APIs, among N APIs, that the APP is not authorized to operate, N being a natural number greater than or equal to 1, L being a natural number greater than or equal to 1, and L being less than or equal to N, R being a natural number greater than or equal to 1, and R being less than or equal to N.