A method of authenticating a first node's identity to a second node in a communication network in order to establish an authenticated connection between the first and second node, the method being characterized by: at the second node, receiving a first authentication certificate from a node purporting to be the first node; at an authentication node, storing a record of queries from a plurality of remote nodes, the record including certificates presented to each of the plurality of remote nodes by a node purporting to be the first node; receiving from the second node a request to authenticate the first node on behalf of the second node, the authentication request including said first authentication certificate; after receiving the authentication request, sending a request message to the first node; receiving a response from the first node, the response including a second authentication certificate belonging to the first node, comparing the first authentication certificate with the second authentication certificate and, in the event that the first and second certificates match, comparing the first certificate with certificates included in the record of queries in order to authenticate the first node's identity and in the event that the first and second certificates do not match, not authenticating the first node's identity; and sending the result of the comparison to the second node. at the second node, receiving a first authentication certificate from a node purporting to be the first node; at an authentication node, storing a record of queries from a plurality of remote nodes, the record including certificates presented to each of the plurality of remote nodes by a node purporting to be the first node; receiving from the second node a request to authenticate the first node on behalf of the second node, the authentication request including said first authentication certificate; after receiving the authentication request, sending a request message to the first node; receiving a response from the first node, the response including a second authentication certificate belonging to the first node, comparing the first authentication certificate with the second authentication certificate and, in the event that the first and second certificates match, comparing the first certificate with certificates included in the record of queries in order to authenticate the first node's identity and in the event that the first and second certificates do not match, not authenticating the first node's identity; and sending the result of the comparison to the second node. storing a record of queries from a plurality of remote nodes, the record including certificates presented to each of the plurality of remote nodes by a node purporting to be the first node; receiving from the second node a request to authenticate the first node on behalf of the second node, the authentication request including said first authentication certificate; after receiving the authentication request, sending a request message to the first node; receiving a response from the first node, the response including a second authentication certificate belonging to the first node, comparing the first authentication certificate with the second authentication certificate and, in the event that the first and second certificates match, comparing the first certificate with certificates included in the record of queries in order to authenticate the first node's identity and in the event that the first and second certificates do not match, not authenticating the first node's identity; and in the event that the first and second certificates match, comparing the first certificate with certificates included in the record of queries in order to authenticate the first node's identity and in the event that the first and second certificates do not match, not authenticating the first node's identity; and sending the result of the comparison to the second node.