A specified application installed on an electronic device is enrolled into a chain of trust provided by a public key infrastructure (PKI). In the chain-OF-trust, child certificates are validated by attestors associated with parent certificates. Enrolling includes generating an application certificate 20-A for verifying that the application is installed on the electronic device, where application certificate 20-A is a descendant of device certificate 20‑D. The application certificate, e.g. X.509, is signed with a private key 24 to provide identity of the electronic device. The application is installed after successful PKI verification of the electronic device. An enrolment flag in installation commands specifies whether the application is to be enrolled, the commands having an embedded certificate signing request. Enrolling is under control of code executed in a trusted environment. The application certificate specifies a version identifier and is generated newly when updating to a new version. Uses includes Internet-OF-Things (IoT) devices.