A solution to create a secure private key vault directly on an IoT device. The root secret is recreated each time in the background for top-level security, and used for secure application private key storage and device certificates. There is no need to record keys in production, they can be installed later in the supply chain or remotely upgraded on already deployed devices.