A system for generating a key certificate used for a home gateway, comprising: a management terminal, configured to submit a request for generating a root key and a root certificate, to submit a request for generating a signature key of a software version for the home gateway, to submit a request for exporting the root certificate, and to acquire the exported root certificate; a data acquisition terminal, configured to submit a request for data of the sowftware version and a signature of the software version, and to acquire signed data of the software version; to submit individualized data of the home gateway, to submit a request for generating a home gateway key and a home gateway certificate and a request for exporting data of a public key corresponding to a private signature key of the software version and to acquire the home gateway key and the home gateway certificate, and the data of the public key corresponding to the private signature key; a key certificate management server, configured to receive the individualized data and the requests from the management terminal and the data acquisition terminal, to notify an encryption machine to perform operations of generating keys and the signature according to the requests, and to perform operations of generating the root certificate according to the request for generating the root certificate and generating the home gateway certificate according to the request for generating the home gateway certificate and the root certificate. the encryption machine, configured to generate the keys and the signature, to save the keys, and to return identifiers corresponding to the root key and the signature key and the signature to the key certificate management server; and to return the home gateway key to the key certificate management server directly. a management terminal, configured to submit a request for generating a root key and a root certificate, to submit a request for generating a signature key of a software version for the home gateway, to submit a request for exporting the root certificate, and to acquire the exported root certificate; a data acquisition terminal, configured to submit a request for data of the sowftware version and a signature of the software version, and to acquire signed data of the software version; to submit individualized data of the home gateway, to submit a request for generating a home gateway key and a home gateway certificate and a request for exporting data of a public key corresponding to a private signature key of the software version and to acquire the home gateway key and the home gateway certificate, and the data of the public key corresponding to the private signature key; a key certificate management server, configured to receive the individualized data and the requests from the management terminal and the data acquisition terminal, to notify an encryption machine to perform operations of generating keys and the signature according to the requests, and to perform operations of generating the root certificate according to the request for generating the root certificate and generating the home gateway certificate according to the request for generating the home gateway certificate and the root certificate. the encryption machine, configured to generate the keys and the signature, to save the keys, and to return identifiers corresponding to the root key and the signature key and the signature to the key certificate management server; and to return the home gateway key to the key certificate management server directly.