This application provides an authentication method and related device and system. The method includes sending, by a first network device, a first next-hop resolution protocol (NHRP) registration request message to the second network device, where the first NHRP registration request message is used to request the second network device to perform digital certificate authentication on the first network device, and the first NHRP registration request message includes first PKI certificate information. The method may further include receiving, by the first network device, a first NHRP registration reply message indicating that the digital certificate authentication performed by the second network device succeeds. In this way, authentication is performed between a spoke device and a hub device using a PKI certificate. This helps reducing authentication workload and improving authentication security.