Method for authenticating nodes (31, 32a-c) of a communication network of an automation installation, wherein - respective authentication information indicating the nodes (31, 32a-c) is transmitted to an authentication server and the authentication server takes the authentication information as a basis for admitting or rejecting the nodes (31, 32a-c) in the communication network as subscribers; characterized in that - the communication network comprises multiple nodes (31, 32a-c) in the form of electronic devices (32a-c) having Ethernet bridges, each of which has at least two communication ports; - at least two of the nodes (31, 32a-c) use their mutually facing communication ports to interchange authentication requests containing their respective authentication information; - the at least two nodes (31, 32a-c) send the respective received authentication information to an authentication server connected to the communication network; - the authentication server uses the respective received authentication information to perform a respective check on the authenticity of the respective node (31, 32a-c) and admits or rejects the respective node (31, 32a-c) in the communication network as a subscriber as the result of the check, characterized in that - the communication network executes a spanning tree protocol, which involves at least one of the nodes (31, 32a-c) being instructed to take an operating state of the communication network as a basis for blocking or activating at least one of its communication ports for the operational data traffic; - the nodes (31, 32a-c) of the communication network forward exclusively such messages as are used for authenticating a node (31, 32a-c) or for reconfiguring the communication network according to the spanning tree protocol, even if they themselves are not fully authenticated. - respective authentication information indicating the nodes (31, 32a-c) is transmitted to an authentication server and the authentication server takes the authentication information as a basis for admitting or rejecting the nodes (31, 32a-c) in the communication network as subscribers; characterized in that - the communication network comprises multiple nodes (31, 32a-c) in the form of electronic devices (32a-c) having Ethernet bridges, each of which has at least two communication ports; - at least two of the nodes (31, 32a-c) use their mutually facing communication ports to interchange authentication requests containing their respective authentication information; - the at least two nodes (31, 32a-c) send the respective received authentication information to an authentication server connected to the communication network; - the authentication server uses the respective received authentication information to perform a respective check on the authenticity of the respective node (31, 32a-c) and admits or rejects the respective node (31, 32a-c) in the communication network as a subscriber as the result of the check, characterized in that - the communication network executes a spanning tree protocol, which involves at least one of the nodes (31, 32a-c) being instructed to take an operating state of the communication network as a basis for blocking or activating at least one of its communication ports for the operational data traffic; - the nodes (31, 32a-c) of the communication network forward exclusively such messages as are used for authenticating a node (31, 32a-c) or for reconfiguring the communication network according to the spanning tree protocol, even if they themselves are not fully authenticated.