A method of providing a certificate for a computing process, comprising: establishing, by at least one processor of a central authority, the central authority being separate from the computing process, a policy by generating policy identifier 'ID' data and associating the policy ID data with at least one certificate; providing, by the central authority, the policy ID data to the computing process; establishing a first trust relationship between the computing process and the central authority, the establishing comprising: authenticating, by the at least one processor of the central authority, the computing process, the authenticating including providing a signed token to the computing process; receiving, by the at least one processor, a request for the certificate from the computing process, the request including the signed token and the policy ID data; determining, by the at least one processor, that the computing process is eligible for the certificate according to the policy that associates the certificate with the policy ID data; and validating, by the at least one processor, the signed token; in response to the establishing, obtaining, by the at least one processor, the certificate, the certificate being signed by a third party certificate authority with which the central authority has a second trust relationship separate from the first trust relationship; and providing, by the at least one processor, the certificate to the computing process. establishing, by at least one processor of a central authority, the central authority being separate from the computing process, a policy by generating policy identifier 'ID' data and associating the policy ID data with at least one certificate; providing, by the central authority, the policy ID data to the computing process; establishing a first trust relationship between the computing process and the central authority, the establishing comprising: authenticating, by the at least one processor of the central authority, the computing process, the authenticating including providing a signed token to the computing process; receiving, by the at least one processor, a request for the certificate from the computing process, the request including the signed token and the policy ID data; determining, by the at least one processor, that the computing process is eligible for the certificate according to the policy that associates the certificate with the policy ID data; and validating, by the at least one processor, the signed token; authenticating, by the at least one processor of the central authority, the computing process, the authenticating including providing a signed token to the computing process; receiving, by the at least one processor, a request for the certificate from the computing process, the request including the signed token and the policy ID data; determining, by the at least one processor, that the computing process is eligible for the certificate according to the policy that associates the certificate with the policy ID data; and validating, by the at least one processor, the signed token; in response to the establishing, obtaining, by the at least one processor, the certificate, the certificate being signed by a third party certificate authority with which the central authority has a second trust relationship separate from the first trust relationship; and <EOS>