A method for cloud-based bootstrapping of a network device, comprising: establishing a first application layer transport layer security, ATLS, connection between a network device and a cloud server outside a local network domain of the network device by sending, from the network device, TLS records in transport protocol message bodies to the cloud server, the ATLS connection transiting at least one transport layer security, TLS, proxy device; sending by the network device via the first ATLS connection to the cloud server a unique identifier of the network device; at the cloud server, determining the local network domain of the device based on the device's unique identifier and returning domain information and trust anchor information to the network device via the first ATLS connection, wherein the domain information includes certificate authority information comprising an identifier of a certificate authority, CA (560, 570), to be used by the network device and the trust anchor information allows the network device to trust the CA; at the network device: receiving, from the cloud server via the first ATLS connection, the identifier for the CA; establishing a second ATLS connection transiting at least one TLS proxy device with the CA associated with the identifier and, in turn, receiving from the CA via the second ATLS connection credentials to access an application service (550, 580) different from the cloud server and the certificate authority; establishing a third ATLS connection transiting at least one TLS proxy device with the application service; and connecting via the third ATLS connection to the application service using the credentials received from the CA. establishing a first application layer transport layer security, ATLS, connection between a network device and a cloud server outside a local network domain of the network device by sending, from the network device, TLS records in transport protocol message bodies to the cloud server, the ATLS connection transiting at least one transport layer security, TLS, proxy device; sending by the network device via the first ATLS connection to the cloud server a unique identifier of the network device; at the cloud server, determining the local network domain of the device based on the device's unique identifier and returning domain information and trust anchor information to the network device via the first ATLS connection, wherein the domain information includes certificate authority information comprising an identifier of a certificate authority, CA (560, 570), to be used by the network device and the trust anchor information allows the network device to trust the CA; at the network device: receiving, from the cloud server via the first ATLS connection, the identifier for the CA; establishing a second ATLS connection transiting at least one TLS proxy device with the CA associated with the identifier and, in turn, receiving from the CA via the second ATLS connection credentials to access an application service (550, 580) different from the cloud server and the certificate authority; establishing a third ATLS connection transiting at least one TLS proxy device with the application service; and connecting via the third ATLS connection to the application service using the credentials received from the CA. receiving, from the cloud server via the first ATLS connection, the identifier for the CA; establishing a second ATLS connection transiting at least one TLS proxy device with the CA associated with the identifier and, in turn, receiving from the CA via the second ATLS connection credentials to access an application service (550, 580) different from the cloud server and the certificate authority; establishing a third ATLS connection transiting at least one TLS proxy device with the application service; and connecting via the third ATLS connection to the application service using the credentials received from the CA.