A method for execution on a computing system, the computing system comprising a service and an infrastructure, wherein the service includes an identity provider, a secure computing resource, and access to a certificate authority and wherein the infrastructure includes a broker, the method comprising: receiving, at the identity provider, a set of credentials from a client device, wherein the client device is separate from the computing system; generating a token at the identity provider indicating validity of the set of credentials in response to determining that the set of credentials meets one or more criteria, the token defining a claim for a single sign-on flow for a user associated with the set of credentials; communicating the token to the client device, wherein the client device is configured to communicate the token with a request to initiate the single sign-on flow for accessing the secure computing resource of the service; receiving, at the broker, the request from the client device for access to the secure computing resource of the service, wherein the request comprises the token that defines the claim for the single sign-on flow; in response to determining that the request comprises the token and the claim generated by the identity provider, causing the secure computing resource to generate an unsigned certificate from the token, wherein the secure computing resource is configured to communicate the unsigned certificate and the token to the identity provider; causing the identity provider to verify the token and to send the unsigned certificate to the certificate authority to generate a signed certificate from the unsigned certificate, wherein the certificate authority comprises security data provided by the user to sign the unsigned certificate; and sending the signed certificate to the secure computing resource, where the signed certificate enables the client device to access the secure computing resource through a connection between the client device and the secure computing resource based on the signed certificate without requiring the client device to resubmit the set of credentials for accessing the secure computing resource. receiving, at the identity provider, a set of credentials from a client device, wherein the client device is separate from the computing system; generating a token at the identity provider indicating validity of the set of credentials in response to determining that the set of credentials meets one or more criteria, the token defining a claim for a single sign-on flow for a user associated with the set of credentials; communicating the token to the client device, wherein the client device is configured to communicate the token with a request to initiate the single sign-on flow for accessing the secure computing resource of the service; receiving, at the broker, the request from the client device for access to the secure computing resource of the service, wherein the request comprises the token that defines the claim for the single sign-on flow; in response to determining that the request comprises the token and the claim generated by the identity provider, causing the secure computing resource to generate an unsigned certificate from the token, wherein the secure computing resource is configured to communicate the unsigned certificate and the token to the identity provider; causing the identity provider to verify the token and to send the unsigned certificate to the certificate authority to generate a signed certificate from the unsigned certificate, wherein the certificate authority comprises security data provided by the user to sign the unsigned certificate; and sending the signed certificate to the secure computing resource, where the signed certificate enables the client device to access the secure computing resource through a connection between the client device and the secure computing resource based on the signed certificate without requiring the client device to resubmit the set of credentials for accessing the secure computing resource.