Method for onboarding an IoT device of a manufacturer in an infrastructure of a customer by means of a first server of a manufacturer domain of the manufacturer and a second server of a customer domain of the customer, involving: a) setting up an authenticated and encrypted first communication channel between the first server and the second server, comprising deriving a session key that is common to the first server and the second server, b) providing an authenticated and encrypted second communication channel between the IoT device and the second server, comprising deriving a second session key that is common to the second server and the IoT device, c) setting up an authenticated and encrypted third communication channel, which runs via the second server, between the IoT device and the first server, to which a third key that is common to the IoT device and the first server is assigned, d) forming permission information by way of the IoT device, e) cryptographically protecting the formed permission information by way of the IoT device by means of the third key, f) transmitting the cryptographically protected permission information from the IoT device to the second server via the second communication channel, g) transmitting the cryptographically protected permission information from the second server to the first server via the first communication channel, h) decrypting the cryptographically protected permission information transmitted from the second server to the first server by way of the first server by means of the third key, i) encrypting the decrypted permission information by way of the first server by means of the first session key, j) transmitting the permission information encrypted with the first session key from the first server to the second server via the first communication channel, k) decrypting the permission information encrypted with the first session key by way of the second server, l) sending a request to obtain a device certificate, associated with the IoT device, of the customer domain from the second server to a certificate authority, m) transmitting the obtained device certificate and the permission information decrypted by the second server from the second server to the IoT device via the second communication channel, and n) accepting the device certificate transmitted by the second server by way of the IoT device if the permission information transmitted by the second server matches the formed permission information. a) setting up an authenticated and encrypted first communication channel between the first server and the second server, comprising deriving a session key that is common to the first server and the second server, b) providing an authenticated and encrypted second communication channel between the IoT device and the second server, comprising deriving a second session key that is common to the second server and the IoT device, c) setting up an authenticated and encrypted third communication channel, which runs via the second server, between the IoT device and the first server, to which a third key that is common to the IoT device and the first server is assigned, d) forming permission information by way of the IoT device, e) cryptographically protecting the formed permission information by way of the IoT device by means of the third key, f) transmitting the cryptographically protected permission information from the IoT device to the second server via the second communication channel, g) transmitting the cryptographically protected permission information from the second server to the first server via the first communication channel, h) decrypting the cryptographically protected permission information transmitted from the second server to the first server by way of the first server by means of the third key, i) encrypting the decrypted permission information by way of the first server by means of the first session key, j) transmitting the permission information encrypted with the first session key from the first server to the second server via the first communication channel, k) decrypting the permission information encrypted with the first session key by way of the second server, l) sending a request to obtain a device certificate, associated with the IoT device, of the customer domain from the second server to a certificate authority, m) transmitting the obtained device certificate and the permission information decrypted by the second server from the second server to the IoT device via the second communication channel, and n) accepting the device certificate transmitted by the second server by way of the IoT device if the permission information transmitted by the second server matches the formed permission information.