A method comprising: in response to an enrollment message received at a provider server, generating by the provider server, a mapping, the enrollment message being received from a customer device and including a device identification number, device ID, of the customer device, the mapping including a one-time password, OTP, that is encrypted using the device ID; generating by the provider server, a quick response, QR, code, the QR code including a uniform resource locator, URL, a provider certificate, CRT, issued by a certificate authority and includes a provider public key, the OTP encrypted using the device ID, and certificate signing request, CSR, content; receiving from the customer device, a confirmation message at a website that is identified by the URL, the confirmation message including a generated public key, a device CSR, and a decrypted OTP; wherein: the generated public key includes a gateway device public key generated with a gateway device private key or the generated public key includes a customer device public key that is generated with a customer device private key, and the device CRT is based on a customer device CSR that certifies ownership of the customer public key by the customer device or the device CRT is based on the gateway device CSR; verifying, by the provider server, the decrypted OTP against the mapping; receiving, by the provider server, the device CRT; communicating to the customer device or the gateway device, by the provider server, one or more application configuration settings, the application configuration settings including information used to configure the customer device or the gateway device for secure communication with the provider server; and securely communicating, by the provider server, information between the provider server and the customer device using the one or more application configuration settings, a provider public key, a provider private key, the generated public key, and a generated private key. in response to an enrollment message received at a provider server, generating by the provider server, a mapping, the enrollment message being received from a customer device and including a device identification number, device ID, of the customer device, the mapping including a one-time password, OTP, that is encrypted using the device ID; generating by the provider server, a quick response, QR, code, the QR code including a uniform resource locator, URL, a provider certificate, CRT, issued by a certificate authority and includes a provider public key, the OTP encrypted using the device ID, and certificate signing request, CSR, content; receiving from the customer device, a confirmation message at a website that is identified by the URL, the confirmation message including a generated public key, a device CSR, and a decrypted OTP; wherein: the generated public key includes a gateway device public key generated with a gateway device private key or the generated public key includes a customer device public key that is generated with a customer device private key, and the device CRT is based on a customer device CSR that certifies ownership of the customer public key by the customer device or the device CRT is based on the gateway device CSR; verifying, by the provider server, the decrypted OTP against the mapping; receiving, by the provider server, the device CRT; communicating to the customer device or the gateway device, by the provider server, one or more application configuration settings, the application configuration settings including information used to configure the customer device or the gateway device for secure communication with the provider server; and securely communicating, by the provider server, information between the provider server and the customer device using the one or more application configuration settings, a provider public key, a provider private key, the generated public key, and a generated private key. the generated public key includes a gateway device public key generated with a gateway device private key or the generated public key includes a customer device public key that is generated with a customer device private key, and the device CRT is based on a customer device CSR that certifies ownership of the customer public key by the customer device or the device CRT is based on the gateway device CSR; verifying, by the provider server, the decrypted OTP against the mapping; receiving, by the provider server, the device CRT; communicating to the customer device or the gateway device, by the provider server, one or more application configuration settings, the application configuration settings including information used to configure the customer device or the gateway device for secure communication with the provider server; and securely communicating, by the provider server, information between the provider server and the customer device using the one or more application configuration settings, a provider public key, a provider private key, the generated public key, and a generated private key.