diff --git a/hawkbit-sdk/hawkbit-sdk-commons/src/main/java/org/eclipse/hawkbit/sdk/Certificate.java b/hawkbit-sdk/hawkbit-sdk-commons/src/main/java/org/eclipse/hawkbit/sdk/Certificate.java
index c3655c97d..cb0cd5ba9 100644
--- a/hawkbit-sdk/hawkbit-sdk-commons/src/main/java/org/eclipse/hawkbit/sdk/Certificate.java
+++ b/hawkbit-sdk/hawkbit-sdk-commons/src/main/java/org/eclipse/hawkbit/sdk/Certificate.java
@@ -76,8 +76,8 @@ public class Certificate {
     private static String toPem(final byte[] ba) {
         final String base64 = Base64.getEncoder().encodeToString(ba);
         final StringBuilder formatted = new StringBuilder();
-        for (int off = 0, end; (end = Math.min(off + 64, base64.length())) >= 0; off = end) {
-            formatted.append(base64, off, end).append("\n");
+        for (int off = 0, len = base64.length(); off < len; off += 64) {
+            formatted.append(base64, off, Math.min(off + 64, len)).append("\n");
         }
         return formatted.toString();
     }
diff --git a/hawkbit-sdk/hawkbit-sdk-commons/src/main/java/org/eclipse/hawkbit/sdk/ca/CA.java b/hawkbit-sdk/hawkbit-sdk-commons/src/main/java/org/eclipse/hawkbit/sdk/ca/CA.java
index 7bfd155d9..afc7f44ef 100644
--- a/hawkbit-sdk/hawkbit-sdk-commons/src/main/java/org/eclipse/hawkbit/sdk/ca/CA.java
+++ b/hawkbit-sdk/hawkbit-sdk-commons/src/main/java/org/eclipse/hawkbit/sdk/ca/CA.java
@@ -25,7 +25,6 @@ import javax.security.auth.x500.X500Principal;
 import lombok.Data;
 import org.bouncycastle.asn1.x509.BasicConstraints;
 import org.bouncycastle.asn1.x509.Extension;
-import org.bouncycastle.asn1.x509.X509Extension;
 import org.bouncycastle.cert.CertIOException;
 import org.bouncycastle.cert.X509v3CertificateBuilder;
 import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
@@ -46,7 +45,7 @@ public class CA {
     private static final String SHA_256_WITH_RSA_ENCRYPTION = "SHA256WithRSAEncryption";
 
     private final Certificate certificate;
-    private long nextSerial = System.currentTimeMillis();
+    private long nextSerial;
 
     // creates a self-signed CA with defaults
     public CA() throws CertificateException {
@@ -55,12 +54,12 @@ public class CA {
 
     // creates a self-signed CA
     public CA(final String caDN, final Date notBefore, final Date notAfter) throws CertificateException {
-        this(selfSign(caDN, notBefore, notAfter));
+        this(selfSign(caDN, notBefore, notAfter), 1);
     }
 
     // create a CA with a key and certificate chain
     public CA(final Certificate certificate) {
-        this(certificate, 0);
+        this(certificate, System.currentTimeMillis());
     }
 
     // create a CA with a key and certificate chain