A computer-implemented method comprising: establishing a connection between a signature device and a host computer via an interface; establishing a transport layer security, TLS, connection between the signature device and the host computer via the interface, by the host computer , sending a command via the interface to the signature device to generate a new key pair consisting of a public key (D_PU) and a private key (D_PR) of the signature device ; by the host computer , receiving a certificate signing request, CSR, including the generated signature device's public key (D_PU) and a device serial number of the signature device from the signature device via the interface; by the host computer , sending the CSR to a user certificate authority; by the user certificate authority, encrypting the public key (D_PU) and the device serial number of the signature device with a certificate authority private key (W_PR) so as to obtain a first certificate with the signature device's public key (D_PU) and device serial number signed by the certificate authority; by the user certificate authority, returning the first certificate and a second certificate with the certificate authority's public key (W_PU) signed by a root certificate authority; by the host computer , receiving the first certificate and the second certificate from the user certificate authority; by the host computer , sending the first certificate and the second certificate to the signature device via the interface, by the signature device , decrypting the public key (D_PU) signed by the certificate authority with the certificate authority public key (W_PU) signed by the root certificate authority, and by the signature device , when the decrypted public key (D_PU) signed by the certificate authority matches the public key (D_PU) on the signature device , storing the first certificate, the second certificate and the new key pair. establishing a connection between a signature device and a host computer via an interface; establishing a transport layer security, TLS, connection between the signature device and the host computer via the interface, by the host computer , sending a command via the interface to the signature device to generate a new key pair consisting of a public key (D_PU) and a private key (D_PR) of the signature device ; by the host computer , receiving a certificate signing request, CSR, including the generated signature device's public key (D_PU) and a device serial number of the signature device from the signature device via the interface; by the host computer , sending the CSR to a user certificate authority; by the user certificate authority, encrypting the public key (D_PU) and the device serial number of the signature device with a certificate authority private key (W_PR) so as to obtain a first certificate with the signature device's public key (D_PU) and device serial number signed by the certificate authority; by the user certificate authority, returning the first certificate and a second certificate with the certificate authority's public key (W_PU) signed by a root certificate authority; by the host computer , receiving the first certificate and the second certificate from the user certificate authority; by the host computer , sending the first certificate and the second certificate to the signature device via the interface, by the signature device , decrypting the public key (D_PU) signed by the certificate authority with the certificate authority public key (W_PU) signed by the root certificate authority, and by the signature device , when the decrypted public key (D_PU) signed by the certificate authority matches the public key (D_PU) on the signature device , storing the first certificate, the second certificate and the new key pair. <EOS>