An authentication system comprising: a memory configured to store a common name and a resource ID in association with each other and in association with an account ID; an establishment unit (31, 501, 509) configured to receive from a storage unit of a communication terminal an encrypted client certificate, the encrypted client certificate including the common name, and decrypt the encrypted client certificate to perform authentication of the communication terminal, thereby establishing a first connection, tls1, with the communication terminal; a receiver (31, 509) configured to receive a request for access authorization from the communication terminal after the first connection, tls1, is established; an output unit (32, 501) configured to obtain the account ID and the resource ID from the memory by using the common name included in the received client certificate as a search key, and output an access token to which a digital signature is added, the access token including the obtained account ID and resource ID, in response to the received request for access authorization, the access token indicating authorization for the communication terminal to access a resource; and a transmitter (31, 509) configured to transmit the access token to the communication terminal, whereby the communication terminal is able to access a resource provision system through a second connection, tls2, different from the first connection, tls1, using the access token, by transmitting a request for resources including the resource ID and the access token to the resource provision system, the resource provision system using the digital signature to check whether the access token was issued by the authentication system, and whereby, when the resource ID included in the request for resources matches the resource ID included in the access token, a URL of a resource corresponding to the resource ID is sent to the communication terminal. a memory configured to store a common name and a resource ID in association with each other and in association with an account ID; an establishment unit (31, 501, 509) configured to receive from a storage unit of a communication terminal an encrypted client certificate, the encrypted client certificate including the common name, and decrypt the encrypted client certificate to perform authentication of the communication terminal, thereby establishing a first connection, tls1, with the communication terminal; receive from a storage unit of a communication terminal an encrypted client certificate, the encrypted client certificate including the common name, and decrypt the encrypted client certificate to perform authentication of the communication terminal, thereby establishing a first connection, tls1, with the communication terminal; a receiver (31, 509) configured to receive a request for access authorization from the communication terminal after the first connection, tls1, is established; an output unit (32, 501) configured to obtain the account ID and the resource ID from the memory by using the common name included in the received client certificate as a search key, and output an access token to which a digital signature is added, the access token including the obtained account ID and resource ID, in response to the received request for access authorization, the access token indicating authorization for the communication terminal to access a resource; and obtain the account ID and the resource ID from the memory by using the common name included in the received client certificate as a search key, and output an access token to which a digital signature is added, the access token including the obtained account ID and resource ID, in response to the received request for access authorization, the access token indicating authorization for the communication terminal to access a resource; and a transmitter (31, 509) configured to transmit the access token to the communication terminal, whereby the communication terminal is able to access a resource provision system through a second connection, tls2, different from the first connection, tls1, using the access token, by transmitting a request for resources including the resource ID and the access token to the resource provision system, the resource provision system using the digital signature to check whether the access token was issued by the authentication system, and whereby, when the resource ID included in the request for resources matches the resource ID included in the access token, a URL of a resource corresponding to the resource ID is sent to the communication terminal.