fig1 is a block diagram illustrating an exemplary digital signature system 100 wherein a receiver such as a signature recipient application 102 wishes to ensure that a mobile end - user is who he / she claims to be . the system comprises a mobile device 104 such as e . g . a mobile station , adapted to be used by an end - user . in this example the mobile device 104 is accessible to the public network internet 106 over a mobile access network 108 and via a wireless public network gateway i . e . in this example a wireless internet gateway 110 constituting an entry into the public network , i . e . in this example the internet 106 . the digital signature system 100 uses asymmetric cryptography , as being part of a pki , for performing digital signatures . a pair of keys , consisting of a private key and a public key , is assigned to the user . the key pair is associated to a certificate , e . g . a x . 509 certificate , through a certification process , whereby the public key is bound to an identity and thereby also the private key . x . 509 is a standard by the international telecommunications union ( itu ) specifying the contents of a digital certificate . the certificate issuing in a pki is performed by a ca , certificate authority . hence , the certificate is a trusted source for the receiver to receive the signer identity or other certified information . a mobile user identity may be e . g . a name , birthday number , mobile station international isdn number ( msisdn ) and / or integrated circuit card identification number ( iccid ). the receiver may for example be an internet bank application , a payment server or any application in the need of authentication ( ensuring the identity of another party ) or non - repudiation ( preventing the denial of previous action ). the receiver 102 is connectable to the internet 106 and is able to communicate with the mobile device 102 of the end user . the receiver 102 is typically implemented as a software application , such as e . g . an internet web server application , running on a computer hardware . the receiver 102 has the ability to verify the digital signature . the mobile device 104 , depicted in fig2 , may be a mobile station , a pager , a personal digital assistant ( pda ), etc . that the user wishes to use for proving for the receiver that he / she is who he / she claims to be , or ensuring the commitment of an action such as signing a payment transaction . the mobile device 104 comprises a transmitting and a receiving means 212 for radio communication with mobile access network 108 . the mobile device 104 comprises a client software 204 such as e . g . a wap user agent or wireless internet browser which may be placed on e . g . the mobile equipment or a smart card of the mobile device 104 , which may be a sim card if the mobile device 104 is a gsm mobile station . the client software 204 is adapted for communicating with the mobile internet gateway 110 . the mobile device 104 further comprises a signing means 206 with the ability to perform digital signatures by means of mathematical algorithms on data sent to the mobile device 104 . the signing means 206 and the user &# 39 ; s private key which e . g . is used for signing of data , is preferably located in a tamper proof device such as a smart card . the mobile device 104 further comprises a displayer 210 wherein messages to be signed may be displayed and input means , e . g . a keyboard , by means of which the user may enter a pin code for access to the private key for performing the signature . referring to fig1 , the wireless internet gateway 110 , from now on called the gateway , is the entry to the public network , in this example the internet 106 , for the mobile device 104 or more specific the mobile station based client software 204 as shown in fig2 . the mobile client 204 communicates with a server within the gateway 110 . according to the present invention a so - called certificate agent 116 is associated to the gateway 110 . this agent is adapted to assisting the mobile device 104 , in its performance of the digital signature procedure , by handling certificates . the agent 116 is able to access a directory 114 , e . g . via the internet , which directory 114 contains certificates , each of them associated to a mobile user e . g . by means of the identity of the mobile device 104 or the identity of the smart card of the mobile device 104 . more than one certificate may be associated to one mobile device . the certificate ( s ) are put into the directory by the certificate authority when issuing the certificate ( s ). this is however outside the scope of this document . the directory 114 may be a x . 500 directory accessed by means of a x . 500 directory protocol ( x . 500 is a directory standard defined by iso and the itu ) or a lightweight directory access protocol ( ldap ) ( defined in rfc 2251 ). upon receipt in the gateway 110 of a signed message on its way from the user to the receiver 102 , the signed message is forwarded to the agent 116 . the agent 116 then retrieves the specific mobile user certificate in the directory 114 by matching a user identity , such as the mobile station international isdn number ( msisdn ) and / or integrated circuit card identification number ( iccid ), as a search criteria . the agent 116 attaches the certificate ( s ) to the signed message , returns the message back to the gateway that forwards it to the receiver 102 . the digital signature as well as certificates may be contained within a cryptographic message structure such as e . g . pcks # 7 , referred to in rfc 2315 as cryptographic message syntax version 1 . 5 . ( rfc is short for request for comments , a series of notes about the internet .) referring to fig1 , an exemplary scenario could be a mobile user that wishes to e . g . buy a cd at a web site or pay a bill in an internet bank . the receiver 102 requests for a signature from the mobile device 104 of the user to ensure that a mobile end - user is who he / she claims to be . the user signs the message e . g . by means of the smart card of the mobile device 104 . instead of transferring the associated certificate from the mobile device 104 to the receiver 102 over a radio carrier with limited bandwidth each time a signing is performed as in prior art , the certificate is in the invention attached to the digital signature created on the mobile device , by the certificate agent 116 associated to the wireless internet gateway . the completed signature is then forwarded to the receiver 102 which verifies it . the signing method according to the present invention will now be described more in detail referring to the signalling diagram in fig3 . the method comprises the following steps : for the receiver 102 to be able to receive a digital signature from the mobile user , the receiver 102 sends a signing request message such as a message in a predefined and agreed protocol including a calling mechanism to the signature capability of the mobile device . the message is sent to the mobile user , i . e . to the mobile client 204 within the user &# 39 ; s mobile device 104 as referred to in fig2 , via the gateway 110 . the receiver 102 may also add instructions / parameters for the agent 116 indicating what service to be performed . the possible instructions / parameters are embedded in the signature request message together with the signature request as well as in a subsequent message from the mobile device 104 to the gateway 110 together with the digital signature . the agent 116 will later in step 306 act in accordance with the instructions / parameters . example of input parameters are : what type of output format of the cryptographic message is requested , e . g . pkcs # 7 or wap signedstring ? should the content be sent back to the receiver 102 with the pkcs # 7 message ? the gateway 110 receives the message and forwards it to the signing means 206 within the mobile device 104 . the mobile device 104 receives the signature request message . the signing means 206 may display the text to be signed in the displayer 210 of the mobile device 104 and prompting the user for his / her pin . the user enters his / her signing personal identification number ( pin ) to the signing means 206 by means of the input means . the signing means 206 obtains the pin and verifies the pin . if the correct pin is entered , the signing means 206 is allowed to access the private key for performing the cryptographic calculation forming the digital signature . the signing means 206 returns the digital signature to the mobile client software 204 which in turn sends the digital signature over the bandwidth restricted mobile access network 108 to the gateway 110 , possibly together with parameters provided in the original message from the receiver 102 . the digital signature is transferred in a message . the gateway 110 receives the digital signature message and relays it to the agent 116 . after receiving the digital signature message , the agent 116 accesses the directory 114 . it retrieves the certificate or certificates of the specific user by means of e . g . an identity of the mobile device 104 or the identity of the smart card such as mobile station international isdn number ( msisdn ) or integrated circuit card identification number ( iccid ), from which the signature carrying message came . if parameters / instructions is included in the message , the agent 116 performs different operations in accordance with these parameters / instructions . one typical instruction would be that the agent 116 attaches the certificates and creates a pkcs # 7 message structure containing the certificate and the digital signature . the new message structure , e . g . pksc # 7 , is passed back to the gateway 110 . if a user has multiple certificates , all certificates may be sent . the gateway 110 forwards the signature and certificate , comprised in a message to the receiver 102 . the method is implemented by means of a computer program product comprising the software code means for performing the steps of the method . the computer program product is run on a computer placed in the gateway domain and implements a certificate handling entity within the digital signature system . the computer program is loaded directly or from a computer usable medium , such as a floppy disc , a cd , the internet etc . the present invention is not limited to the above - described preferred embodiments . various alternatives , modifications and equivalents may be used . therefore , the above embodiments should not be taken as limiting the scope of the invention , which is defined by the appending claims .