A system for authenticating a communications channel between a mobile handset associated with a user and an application server, for uniquely identifying the mobile handset and for encrypting communications between the mobile handset and the application server over the communication channel, the system including a certificate authority, a user side software application installed on the mobile handset, and a server side software application installed on the application server, wherein: the user side software application is configured to utilize a user side encryption module provided by the certificate authority and to automatically request a digital user certificate from the certificate authority; the certificate authority is adapted to, upon receiving the request, calculate a user private and public key pair (31, 33) on behalf of the mobile handset if the mobile handset does not have enough processing power to do so itself, to create and issue the user certificate to the mobile handset, the user certificate including at least one identifier which is uniquely associated with the mobile handset and the user public key, and to transmit the user private key to the mobile handset over a secure communications channel established between the certificate authority and mobile handset by means of a suitable key exchange protocol; the server side software application is configured to utilize a server side encryption module provided by the certificate authority and to request and receive the user certificate from the mobile handset, to validate it as originating from the certificate authority using the server side encryption module, to uniquely identify the mobile handset from the identifier in the user certificate, and to transmit a digital server certificate issued to it by the certificate authority to the mobile handset where it is received by the user side software application and validated as originating from the certificate authority using the user side encryption module; and upon successful validation of the user certificate by the server side software application and of the server certificate by the user side software application, the user side software application and the server side software application are further configured to share encryption keys utilizing their respective certificates to provide encryption, the encryption keys being useful for further data encryption between the mobile handset and the application server. the user side software application is configured to utilize a user side encryption module provided by the certificate authority and to automatically request a digital user certificate from the certificate authority; the certificate authority is adapted to, upon receiving the request, calculate a user private and public key pair (31, 33) on behalf of the mobile handset if the mobile handset does not have enough processing power to do so itself, to create and issue the user certificate to the mobile handset, the user certificate including at least one identifier which is uniquely associated with the mobile handset and the user public key, and to transmit the user private key to the mobile handset over a secure communications channel established between the certificate authority and mobile handset by means of a suitable key exchange protocol; the server side software application is configured to utilize a server side encryption module provided by the certificate authority and to request and receive the user certificate from the mobile handset, to validate it as originating from the certificate authority using the server side encryption module, to uniquely identify the mobile handset from the identifier in the user certificate, and to transmit a digital server certificate issued to it by the certificate authority to the mobile handset where it is received by the user side software application and validated as originating from the certificate authority using the user side encryption module; and upon successful validation of the user certificate by the server side software application and of the server certificate by the user side software application, the user side software application and the server side software application are further configured to share encryption keys utilizing their respective certificates to provide encryption, the encryption keys being useful for further data encryption between the mobile handset and the application server.