A computer-implemented method for providing, by a server (SRV), a first digital certificate (CERT-1) to a device (DEV), comprising: - receiving (REC-AD), from the device (DEV), authentication data (AD) via a secure communication channel, - receiving (REC-IDF-CERT), from the device (DEV), or determining (DET-IDF-CERT), by the server (SRV), a first certificate identifier (IDF-CERT-1), in particular, wherein the first certificate identifier (IDF-CERT-1) is a hash value or random value, - verifying (VRF-AD) the authentication data (AD), - receiving (REC-PBK-1), from the device (DEV), a first public key (PBK-1) created by the device (DEV), - sending (SND-CSR-1) a first certificate signing request (CSR-1) related to a first domain name (DN-1) based on the first public key (PBK-1) to a certificate authority (CA), wherein the first domain name (DN-1) comprises the certificate identifier (IDF-CERT-1), - receiving (REC-CERT-1) the first digital certificate (CERT-1) from the certificate authority (CA), wherein the first digital certificate (CERT-1) is a wildcard certificate based on the first domain name (DN-1) and the first public key (PBK-1) signed by the certificate authority (CA), - providing (PROV-CERT-1) the first digital certificate (CERT-1) to the device (DEV), characterized in that a domain related to the first domain name (DN-1) is controlled by the server (SRV), the first certificate identifier (IDF-CERT-1) is a label of the first domain name (DN-1) different from the last label of the first domain name (DN-1). - receiving (REC-AD), from the device (DEV), authentication data (AD) via a secure communication channel, - receiving (REC-IDF-CERT), from the device (DEV), or determining (DET-IDF-CERT), by the server (SRV), a first certificate identifier (IDF-CERT-1), in particular, wherein the first certificate identifier (IDF-CERT-1) is a hash value or random value, - verifying (VRF-AD) the authentication data (AD), - receiving (REC-PBK-1), from the device (DEV), a first public key (PBK-1) created by the device (DEV), - sending (SND-CSR-1) a first certificate signing request (CSR-1) related to a first domain name (DN-1) based on the first public key (PBK-1) to a certificate authority (CA), wherein the first domain name (DN-1) comprises the certificate identifier (IDF-CERT-1), - receiving (REC-CERT-1) the first digital certificate (CERT-1) from the certificate authority (CA), wherein the first digital certificate (CERT-1) is a wildcard certificate based on the first domain name (DN-1) and the first public key (PBK-1) signed by the certificate authority (CA), - providing (PROV-CERT-1) the first digital certificate (CERT-1) to the device (DEV), characterized in that a domain related to the first domain name (DN-1) is controlled by the server (SRV), the first certificate identifier (IDF-CERT-1) is a label of the first domain name (DN-1) different from the last label of the first domain name (DN-1). characterized in that a domain related to the first domain name (DN-1) is controlled by the server (SRV), the first certificate identifier (IDF-CERT-1) is a label of the first domain name (DN-1) different from the last label of the first domain name (DN-1). <EOS>