A device comprising: on-chip non-volatile - NV - memory that stores information programmed during a secure manufacturing process, the information including: a device ID; a stored private key; an issuer ID; a first signature; a certificate generating module coupled to the on-chip NV memory and configured to: read the device ID, the stored private key, the issuer ID, and the first signature from the on-chip NV memory in response to a request for a device certificate; compute a public key as a function of the stored private key read from the on-chip NV memory; construct the device certificate as a function of the device ID, the issuer ID, the public key, and the first signature; an interface coupled to the certificate generating module , wherein, in operation, the request for the device certificate is received on the interface , the certificate generating module constructs the device certificate; wherein the device is further configured to: create a temporary key pair having two keys, a temporary public key and a temporary private key, using a random number generator; create an application certificate by signing data including the temporary public key, using the stored private key; using the temporary private key to compute a second signature as a function of a received random number; and wherein the application certificate is sent via the interface in response to the request, along with the second signature, the random number and the device certificate. on-chip non-volatile - NV - memory that stores information programmed during a secure manufacturing process, the information including: a device ID; a stored private key; an issuer ID; a first signature; a device ID; a stored private key; an issuer ID; a first signature; a certificate generating module coupled to the on-chip NV memory and configured to: read the device ID, the stored private key, the issuer ID, and the first signature from the on-chip NV memory in response to a request for a device certificate; compute a public key as a function of the stored private key read from the on-chip NV memory; construct the device certificate as a function of the device ID, the issuer ID, the public key, and the first signature; read the device ID, the stored private key, the issuer ID, and the first signature from the on-chip NV memory in response to a request for a device certificate; compute a public key as a function of the stored private key read from the on-chip NV memory; construct the device certificate as a function of the device ID, the issuer ID, the public key, and the first signature; an interface coupled to the certificate generating module , wherein, in operation, the request for the device certificate is received on the interface , the certificate generating module constructs the device certificate; wherein the device is further configured to: create a temporary key pair having two keys, a temporary public key and a temporary private key, using a random number generator; create an application certificate by signing data including the temporary public key, using the stored private key; using the temporary private key to compute a second signature as a function of a received random number; and create a temporary key pair having two keys, a temporary public key and a temporary private key, using a random number generator; create an application certificate by signing data including the temporary public key, using the stored private key; using the temporary private key to compute a second signature as a function of a received random number; and wherein the application certificate is sent via the interface in response to the request, along with the second signature, the random number and the device certificate. <EOS>