A method for operating an integrated circuit chip comprising a first digital certificate of an issuing authority, a patch server, an issuing-authority server, and a terminal to securely patch an operating system of the integrated circuit chip, the method comprising: operating the patch server to encrypt a patch to the operating system of the integrated circuit chip; operating the patch server to transmit the encrypted patch to the issuing-authority server; wherein the method is characterized in that operating the issuing-authority server to append the encrypted patch into a second digital certificate of the issuing authority in an extension to the second digital certificate; operating the issuing-authority server to transmit the second digital certificate including the encrypted patch to the terminal; operating the terminal to communicate with the integrated circuit chip upon presentation of the integrated circuit chip to the terminal; operating the terminal to transmit the second digital certificate including the encrypted patch to the integrated circuit chip; operating the integrated circuit chip to unpack the second digital certificate including the encrypted patch to recover the extension to the second digital certificate; and operating the integrated circuit chip to verify that the extension to the second digital certificate corresponds to the operating system of the integrated circuit chip; and if the extension is verified to correspond to the operating system of the integrated circuit chip, to decrypt the extension to the second digital certificate thereby recovering the patch to the operating system of the integrated circuit chip, and installing the patch into the operating system of the integrated circuit chip, operating the patch server to digitally sign the encrypted patch; and operating the integrated circuit chip to verify the digital signature of encrypted patch prior to installing the patch into the operating system of the integrated circuit chip. operating the patch server to encrypt a patch to the operating system of the integrated circuit chip; operating the patch server to transmit the encrypted patch to the issuing-authority server; operating the issuing-authority server to append the encrypted patch into a second digital certificate of the issuing authority in an extension to the second digital certificate; operating the issuing-authority server to transmit the second digital certificate including the encrypted patch to the terminal; operating the terminal to communicate with the integrated circuit chip upon presentation of the integrated circuit chip to the terminal; operating the terminal to transmit the second digital certificate including the encrypted patch to the integrated circuit chip; operating the integrated circuit chip to unpack the second digital certificate including the encrypted patch to recover the extension to the second digital certificate; and operating the integrated circuit chip to verify that the extension to the second digital certificate corresponds to the operating system of the integrated circuit chip; and if the extension is verified to correspond to the operating system of the integrated circuit chip, to decrypt the extension to the second digital certificate thereby recovering the patch to the operating system of the integrated circuit chip, and installing the patch into the operating system of the integrated circuit chip, operating the patch server to digitally sign the encrypted patch; and operating the integrated circuit chip to verify the digital signature of encrypted patch prior to installing the patch into the operating system of the integrated circuit chip.