An apparatus comprising a processor and a memory, wherein the processor and the memory are configured to provide a secure execution environment, and wherein the memory comprises a hardware unique key and a class key, wherein the processor is configured to in the secure execution environment: recover a certificate signing key based on the class key, wherein the certificate signing key is associated with a first certificate authority; derive a device key pair based on the hardware unique key, wherein the device key pair comprises a device public key and a device private key; and generate a device certificate based on the device public key and the certificate signing key, wherein the device certificate is configured to be validated based on a public key associated with the first certificate authority, characterized in that the memory comprises a class diversifier value and the processor is configured to recover the certificate signing key based on the class key and the class diversifier value, and at least one of - the memory comprises a device diversifier value, and the processor is configured to derive the device key pair based on the hardware unique key and the device diversifier value, the processor is configured to: update the device diversifier value; derive an updated device key pair based on the hardware unique key and the updated device diversifier value, wherein the updated device key pair comprises an updated device public key and an updated device private key; and generate an updated device certificate based on the updated device public key and the certificate signing key, and/or - the processor is configured to: update the class diversifier value; recover an updated certificate signing key based on the updated class diversifier value and the class key, wherein the updated certificate signing key is associated with a second certificate authority; and generate an updated device certificate based on the updated certificate signing key and the device public key, wherein the updated device certificate is configured to be validated based on a public key associated with the second certificate authority. recover a certificate signing key based on the class key, wherein the certificate signing key is associated with a first certificate authority; derive a device key pair based on the hardware unique key, wherein the device key pair comprises a device public key and a device private key; and generate a device certificate based on the device public key and the certificate signing key, wherein the device certificate is configured to be validated based on a public key associated with the first certificate authority, characterized in that the memory comprises a class diversifier value and the processor is configured to recover the certificate signing key based on the class key and the class diversifier value, and - the memory comprises a device diversifier value, and the processor is configured to derive the device key pair based on the hardware unique key and the device diversifier value, the processor is configured to: update the device diversifier value; derive an updated device key pair based on the hardware unique key and the updated device diversifier value, wherein the updated device key pair comprises an updated device public key and an updated device private key; and generate an updated device certificate based on the updated device public key and the certificate signing key, and/or update the device diversifier value; derive an updated device key pair based on the hardware unique key and the updated device diversifier value, wherein the updated device key pair comprises an updated device public key and an updated device private key; and generate an updated device certificate based on the updated device public key and the certificate signing key, - the processor is configured to: update the class diversifier value; recover an updated certificate signing key based on the updated class diversifier value and the class key, wherein the updated certificate signing key is associated with a second certificate authority; and generate an updated device certificate based on the updated certificate signing key and the device public key, wherein the updated device certificate is configured to be validated based on a public key associated with the second certificate authority. update the class diversifier value; recover an updated certificate signing key based on the updated class diversifier value and the class key, wherein the updated certificate signing key is associated with a second certificate authority; and generate an updated device certificate based on the updated certificate signing key and the device public key, wherein the updated device certificate is configured to be validated based on a public key associated with the second certificate authority.