A system, method and apparatus to authenticate an endpoint having a secure memory device. For example, at boot time of the endpoint, a cryptographic hash value of the boot loader stored in the memory device is used to generate a device identifier of the memory device; and identification data of multiple components of the endpoint is used with the device identifier of the memory device to generate a first key pair key and a second key. A counter value is retrieved from a monotonic counter to generate a certificate signed using a private key in the first key pair. The certificate can be sent over the computer network to a remote server for authentication using a public key in the first key pair. The second key pair can be authenticated and used to establish encryption for a communication connection between the endpoint and the server.