A method for digital certificate management by entities including a certificate authority, CA, and a registration authority, RA, the digital certificates being for use by devices in authentication operations, wherein each digital certificate is to be activated by an activation code associated with the digital certificate, the method comprising: receiving, by the RA, a plurality of device requests from a plurality of devices, each device request requesting one or more digital certificates for the associated device; for each device request, performing operations of: obtaining by the RA, using information on the associated device, first activation data associated with the device; generating, by the RA, a plurality of certificate generation requests, each certificate generation request comprising associated certificate activation data generated from the first activation data; sending to the CA, by the RA, each certificate generation request, wherein the CA is unable to link the certificate generation request to the associated device, and the CA is unable to link the certificate activation data in the certificate generation request to the associated first activation data based on shuffling of the RA; wherein the CA is operable to generate, from each certificate generation request, a digital encrypted package which is an encryption of a digital package comprising an associated digital certificate which is recoverable from the encrypted package using an activation code associated with the certificate activation data. receiving, by the RA, a plurality of device requests from a plurality of devices, each device request requesting one or more digital certificates for the associated device; for each device request, performing operations of: obtaining by the RA, using information on the associated device, first activation data associated with the device; generating, by the RA, a plurality of certificate generation requests, each certificate generation request comprising associated certificate activation data generated from the first activation data; sending to the CA, by the RA, each certificate generation request, wherein the CA is unable to link the certificate generation request to the associated device, and the CA is unable to link the certificate activation data in the certificate generation request to the associated first activation data based on shuffling of the RA; wherein the CA is operable to generate, from each certificate generation request, a digital encrypted package which is an encryption of a digital package comprising an associated digital certificate which is recoverable from the encrypted package using an activation code associated with the certificate activation data. obtaining by the RA, using information on the associated device, first activation data associated with the device; generating, by the RA, a plurality of certificate generation requests, each certificate generation request comprising associated certificate activation data generated from the first activation data; sending to the CA, by the RA, each certificate generation request, wherein the CA is unable to link the certificate generation request to the associated device, and the CA is unable to link the certificate activation data in the certificate generation request to the associated first activation data based on shuffling of the RA; wherein the CA is operable to generate, from each certificate generation request, a digital encrypted package which is an encryption of a digital package comprising an associated digital certificate which is recoverable from the encrypted package using an activation code associated with the certificate activation data.