A method of providing a customer-specific digital certificate to a client device, in a system comprising a plurality of customers providing services to a plurality of client devices, the method comprising: receiving (5.), in an online certificate authority, a pre-generated digital certificate and an encrypted client device private key encrypted according to a private key encryption key PrKEK; receiving (7.), from the client device, a request for the customer-specific digital certificate, the request comprising at least one of client device identifying information and information identifying the customer, the request signed according to a pre-provisioned client device digital certificate; building the customer-specific digital certificate from the pre-generated digital certificate, a selected target digital certificate template, template, the client device identifying information, and the customer identifying information, comprising: identifying (9.) the client device from the client device identifying information: identifying (9.) the customer; retrieving (10.) the pre-generated digital certificate; selecting (11.) the target digital certificate template for the client device based at least in part upon the information identifying the customer, the target digital certificate template having attributes that vary according to the customer; generating (13.) the customer-specific digital certificate according to the retrieved pre-generated digital certificate, the target digital certificate template and the client device identifying information; accessing (12.) an customer-specific digital certificate signing key from a certificate authority associated with the identified customer; re-signing (14.) the customer specific digital certificate with the customer specific digital certificate signing key; and transmitting (15.) the customer-specific digital certificate and the encrypted client device private key to the client device. receiving (5.), in an online certificate authority, a pre-generated digital certificate and an encrypted client device private key encrypted according to a private key encryption key PrKEK; receiving (7.), from the client device, a request for the customer-specific digital certificate, the request comprising at least one of client device identifying information and information identifying the customer, the request signed according to a pre-provisioned client device digital certificate; building the customer-specific digital certificate from the pre-generated digital certificate, a selected target digital certificate template, template, the client device identifying information, and the customer identifying information, comprising: identifying (9.) the client device from the client device identifying information: identifying (9.) the customer; retrieving (10.) the pre-generated digital certificate; selecting (11.) the target digital certificate template for the client device based at least in part upon the information identifying the customer, the target digital certificate template having attributes that vary according to the customer; generating (13.) the customer-specific digital certificate according to the retrieved pre-generated digital certificate, the target digital certificate template and the client device identifying information; accessing (12.) an customer-specific digital certificate signing key from a certificate authority associated with the identified customer; re-signing (14.) the customer specific digital certificate with the customer specific digital certificate signing key; and identifying (9.) the customer; retrieving (10.) the pre-generated digital certificate; selecting (11.) the target digital certificate template for the client device based at least in part upon the information identifying the customer, the target digital certificate template having attributes that vary according to the customer; generating (13.) the customer-specific digital certificate according to the retrieved pre-generated digital certificate, the target digital certificate template and the client device identifying information; accessing (12.) an customer-specific digital certificate signing key from a certificate authority associated with the identified customer; re-signing (14.) the customer specific digital certificate with the customer specific digital certificate signing key; and transmitting (15.) the customer-specific digital certificate and the encrypted client device private key to the client device.