A method for checking the validity of a certificate generated by an ID token of a user for a security token of the same user, wherein the ID token has a protected memory area, in which there is stored at least one first private key of a first cryptographic key pair consisting of the first private key and a first public key, and wherein a certificate of a document PKI is associated with the ID token, wherein a certificate of an authorisation PKI is associated with the security token and is stored on the security token, wherein a write authorisation for write access by the security token to the protected memory area of the ID token is defined in the certificate of the authorisation PKI, wherein the certificate of the authorisation PKI may be used for authentication of the security token to the ID token, wherein the certificate of the authorisation PKI contains a public sector key, which is associated with a sector from a plurality of predefined sectors and is identical for all security tokens of the same sector, wherein a private key of a cryptographic key pair generated by the security token, said private key being associated with the generated certificate and said cryptographic key pair consisting of the private key and a public key, is stored on the security token, and wherein at least one first sector-specific identifier associated with the ID token is stored on the security token and is calculated from the first private key of the ID token and the public sector key of the security token, wherein the certificate generated by the ID token is a certificate which is derived from the certificate of the document PKI and stored on the security token and contains the public sector key or a value cryptographically derived therefrom and the public key of the cryptographic key pair generated by the security token, wherein the method comprises the following steps: - executing a first database query of a first blocking database by a first check computer system in order to ascertain a blocked status of the ID token, wherein the first blocking database is configured in such a way that the blocked status of the ID token may be queried from said database, - generating a first check signal by the first check computer system, which signal indicates the result of the first database query, - executing a second database query of a second blocking database by a second check computer system in order to ascertain a blocked status of the generated certificate, wherein the second blocking database is configured in such a way that the blocked status of the generated certificate may be queried from said database, - generating a second check signal by the second check computer system, which signal indicates the result of the second database query, - generating a validity signal, which indicates the validity of the generated certificate on the precondition that the first check signal indicates that the ID token is not blocked and the second checked signal indicates that the generated certificate is not blocked. - executing a first database query of a first blocking database by a first check computer system in order to ascertain a blocked status of the ID token, wherein the first blocking database is configured in such a way that the blocked status of the ID token may be queried from said database, - generating a first check signal by the first check computer system, which signal indicates the result of the first database query, - executing a second database query of a second blocking database by a second check computer system in order to ascertain a blocked status of the generated certificate, wherein the second blocking database is configured in such a way that the blocked status of the generated certificate may be queried from said database, - generating a second check signal by the second check computer system, which signal indicates the result of the second database query, - generating a validity signal, which indicates the validity of the generated certificate on the precondition that the first check signal indicates that the ID token is not blocked and the second checked signal indicates that the generated certificate is not blocked.