Method and apparatus for certifying an application-specific key and for requesting such certification

The method for requesting certification for an application-specific key pair by an application (20) in an apparatus (10), comprising:

• generating (110) an application-specific cryptographic key pair that comprises a secret application-specific key (18) and a public application-specific key;
• obtaining (116) an attestation certificate (22) for the application-specific key pair from an attestation module in the apparatus (10);
• transmitting (120) the attestation certificate (22) to a certificate exchange service (30);
• obtaining (150) a new application-specific certificate (24) for the key pair from the certificate exchange service, wherein the new application-specific certificate (24) comprises at least the public application-specific key and further information.

A non-transitory, computer readable storage medium containing instructions that when executed by a computer causes the computer to certify an application-specific cryptographic key in a certificate exchange service (30), by:

• receiving (130) a cryptographic attestation certificate (22) for an application-specific public key from an application (20) in an apparatus (10);
• checking (34;
• 136) the validity of the attestation certificate (22);
• and,
• if the attestation certificate (22) has been recognized as valid, comparing (34;
• 138) at least some information that has been extracted from the attestation certificate (22) with predefined reference information, and
• if the comparison reveals that a new certificate should be created, forming (36;
• 140) a new application-specific certificate (24) that comprises at least the application-specific public key extracted from the attestation certificate (22) and at least some of the information from the attestation certificate;
• and transmitting (150) the new application-specific certificate (24) to the application (20) in the apparatus (10).