A method for generating a second certificate derived from a first certificate of a document PKI using a first portable device and a second device, the first certificate being associated with a user and containing a first public key with which a first private key is associated, the first device comprising a non-volatile electronic memory including a protected memory area in which at least one identifier and the first private key of the first certificate of the document PKI are stored, access to the protected memory area only being possible via a first processor of the first device, and the first device comprising a first communication interface for communicating with the second device, the second device comprising a second communication interface for communicating with the first device, and the method comprising the following steps: - authenticating the user with respect to the first device; - establishing time information for the derived second certificate by the second device; - selecting at least one identifier associated with the user from the protected memory area of the first device for the derived second certificate; - establishing at least one attribute limiting a usability of the derived second certificate by the second device; - generating a cryptographic key pair for the derived second certificate, comprising a second private key and a second public key, by means of the first processor of the first device; - generating a data set, comprising the generated second public key, the time information, the at least one identifier and the at least one limiting attribute; - creating a signature for the data set with the first private key of the first certificate by the first device; - transmitting the signature from the first device to the second device via the first and second communication interfaces (118, 119) for providing the derived second certificate in the form of the data set with the signature on the second device; and - transmitting the second private key of the derived second certificate from the first device to the second device via the first and second communication interfaces (118, 119). - authenticating the user with respect to the first device; - establishing time information for the derived second certificate by the second device; - selecting at least one identifier associated with the user from the protected memory area of the first device for the derived second certificate; - establishing at least one attribute limiting a usability of the derived second certificate by the second device; - generating a cryptographic key pair for the derived second certificate, comprising a second private key and a second public key, by means of the first processor of the first device; - generating a data set, comprising the generated second public key, the time information, the at least one identifier and the at least one limiting attribute; - creating a signature for the data set with the first private key of the first certificate by the first device; - transmitting the signature from the first device to the second device via the first and second communication interfaces (118, 119) for providing the derived second certificate in the form of the data set with the signature on the second device; and - transmitting the second private key of the derived second certificate from the first device to the second device via the first and second communication interfaces (118, 119).