A method performed on a mobile device for secure on-line sign-up and provisioning for Wi-Fi Hotspot 2.0 networks, the method comprising: associating with a Wi-Fi Hotspot and establishing a transport-layer security,TLS, session with a sign-up server through the Wi-Fi Hotspot to receive a certificate of the sign-up server; verifying that the certificate of the sign-up server has been signed by a hotspot trust root; sending an OMA-DM, Open Mobile Alliance Device Management, package 1 message to the sign-up-server, the OMA-DM package 1 message including device information and a generic alert that is set to subscription creation; receiving from the sign-up-server an OMA-DM package 2 message that includes a Launch-Browser-to-URL command for execution by the mobile device in response to the package 1 message; establishing by the mobile device, upon receipt of the OMA-DM package 2 message, a secure Hypertext Transfer Protocol, HTTPS, connection to a URL identified in the OMA-DM package 2 message and sending an HTTPS GET request over the secure HTTP connection to the identified URL, the URL being associated with an activation portal; exchanging information over the established secure HTTP connection with the activation portal to provision credentials for establishment of a subscription for Wi-Fi network access and creation of a subscription management object, MO, receiving an indication from the sign-up server that subscription was provisioned successfully along with the URL from which the subscription MO can be retrieved, the URL being received as part of a HTTPS response message; retrieving the subscription MO; disassociating with the Wi-Fi Hotspot; and associating with the Wi-Fi Hotspot using the retrieved subscription MO. associating with a Wi-Fi Hotspot and establishing a transport-layer security,TLS, session with a sign-up server through the Wi-Fi Hotspot to receive a certificate of the sign-up server; verifying that the certificate of the sign-up server has been signed by a hotspot trust root; sending an OMA-DM, Open Mobile Alliance Device Management, package 1 message to the sign-up-server, the OMA-DM package 1 message including device information and a generic alert that is set to subscription creation; receiving from the sign-up-server an OMA-DM package 2 message that includes a Launch-Browser-to-URL command for execution by the mobile device in response to the package 1 message; establishing by the mobile device, upon receipt of the OMA-DM package 2 message, a secure Hypertext Transfer Protocol, HTTPS, connection to a URL identified in the OMA-DM package 2 message and sending an HTTPS GET request over the secure HTTP connection to the identified URL, the URL being associated with an activation portal; exchanging information over the established secure HTTP connection with the activation portal to provision credentials for establishment of a subscription for Wi-Fi network access and creation of a subscription management object, MO, receiving an indication from the sign-up server that subscription was provisioned successfully along with the URL from which the subscription MO can be retrieved, the URL being received as part of a HTTPS response message; retrieving the subscription MO; disassociating with the Wi-Fi Hotspot; and associating with the Wi-Fi Hotspot using the retrieved subscription MO.