A method in a first server for establishing a secure session with a client device where a private key used for the secure session is stored in a second server, the method comprising: receiving a message from the client device that initiates a procedure to establish the secure session between the client device and the first server; transmitting a digital certificate to the client device that includes a public key; generating a set of cryptographic parameters; transmitting, to the second server, a message that includes the set of cryptographic parameters, wherein the second server has the private key that corresponds to the public key; receiving from the second server, a message that includes the set of cryptographic parameters that have been signed using the private key; transmitting, to the client device, the set of cryptographic parameters that have been signed using the private key; receiving, from the client device, a value generated by the client device based in part on the set of cryptographic parameters; generating, using the received value and at least some of the set of cryptographic parameters, a premaster secret; generating a master secret using the premaster secret; generating, using the generated master secret, a set of one or more session keys to be used in the secure session for encrypting and decrypting communication between the client device and the first server; receiving, from the client device over the secure session, a request for a resource of a domain of the second server, wherein the second server is an origin server, and wherein the request is encrypted; decrypting the request for the resource using at least one of the set of session keys; retrieving the requested resource from the second server; generating a response that includes the retrieved resource; encrypting the generated response with at least one of the set of session keys; and transmitting the encrypted response to the client device. receiving a message from the client device that initiates a procedure to establish the secure session between the client device and the first server; transmitting a digital certificate to the client device that includes a public key; generating a set of cryptographic parameters; transmitting, to the second server, a message that includes the set of cryptographic parameters, wherein the second server has the private key that corresponds to the public key; receiving from the second server, a message that includes the set of cryptographic parameters that have been signed using the private key; transmitting, to the client device, the set of cryptographic parameters that have been signed using the private key; receiving, from the client device, a value generated by the client device based in part on the set of cryptographic parameters; generating, using the received value and at least some of the set of cryptographic parameters, a premaster secret; generating a master secret using the premaster secret; generating, using the generated master secret, a set of one or more session keys to be used in the secure session for encrypting and decrypting communication between the client device and the first server; receiving, from the client device over the secure session, a request for a resource of a domain of the second server, wherein the second server is an origin server, and wherein the request is encrypted; decrypting the request for the resource using at least one of the set of session keys; retrieving the requested resource from the second server; generating a response that includes the retrieved resource; encrypting the generated response with at least one of the set of session keys; and transmitting the encrypted response to the client device.