A computer-implemented method comprising: establishing a connection between a signature device (100, 300) and a host computer (200, 302) via an interface; establishing a transport layer security, TLS, connection between the signature device (100, 300) and the host computer (200, 302) via the interface, by the host computer (200, 302), sending a command via the interface to the signature device (100, 300) to generate a new key pair consisting of a public key (D_PU) and a private key (D_PR) of the signature device (100, 300); by the host computer (200, 302), receiving a certificate signing request, CSR, including the generated signature device's public key (D_PU) and a device serial number of the signature device (100, 300) from the signature device (100, 300) via the interface; by the host computer (200, 302), sending the CSR to a user certificate authority; by the user certificate authority, encrypting (315, 316) the public key (D_PU) and the device serial number of the signature device with a certificate authority private key (W_PR) so as to obtain a first certificate with the signature device's public key (D_PU) and device serial number signed by the certificate authority; by the user certificate authority, returning the first certificate and a second certificate with the certificate authority's public key (W_PU) signed by a root certificate authority; by the host computer (200, 302), receiving the first certificate and the second certificate from the user certificate authority; by the host computer (200, 302), sending the first certificate and the second certificate to the signature device (100, 300) via the interface, by the signature device (100, 300), decrypting the public key (D_PU) signed by the certificate authority with the certificate authority public key (W_PU) signed by the root certificate authority, and by the signature device (100,300), when the decrypted public key (D_PU) signed by the certificate authority matches the public key (D_PU) on the signature device (100, 300), storing the first certificate, the second certificate and the new key pair. establishing a connection between a signature device (100, 300) and a host computer (200, 302) via an interface; establishing a transport layer security, TLS, connection between the signature device (100, 300) and the host computer (200, 302) via the interface, by the host computer (200, 302), sending a command via the interface to the signature device (100, 300) to generate a new key pair consisting of a public key (D_PU) and a private key (D_PR) of the signature device (100, 300); by the host computer (200, 302), receiving a certificate signing request, CSR, including the generated signature device's public key (D_PU) and a device serial number of the signature device (100, 300) from the signature device (100, 300) via the interface; by the host computer (200, 302), sending the CSR to a user certificate authority; by the user certificate authority, encrypting (315, 316) the public key (D_PU) and the device serial number of the signature device with a certificate authority private key (W_PR) so as to obtain a first certificate with the signature device's public key (D_PU) and device serial number signed by the certificate authority; by the user certificate authority, returning the first certificate and a second certificate with the certificate authority's public key (W_PU) signed by a root certificate authority; by the host computer (200, 302), receiving the first certificate and the second certificate from the user certificate authority; by the host computer (200, 302), sending the first certificate and the second certificate to the signature device (100, 300) via the interface, by the signature device (100, 300), decrypting the public key (D_PU) signed by the certificate authority with the certificate authority public key (W_PU) signed by the root certificate authority, and by the signature device (100,300), when the decrypted public key (D_PU) signed by the certificate authority matches the public key (D_PU) on the signature device (100, 300), storing the first certificate, the second certificate and the new key pair.