A method in a first server for establishing a secure session with a client device where a private key used for the secure session is stored in a second server , the method comprising: receiving a message from the client device that initiates a procedure to establish the secure session between the client device and the first server ; transmitting a digital certificate to the client device that includes a public key; generating a set of cryptographic parameters; transmitting , to the second server , a message that includes the set of cryptographic parameters, wherein the second server has the private key that corresponds to the public key; receiving from the second server , a message that includes the set of cryptographic parameters that have been signed using the private key ; transmitting , to the client device , the set of cryptographic parameters that have been signed using the private key ; receiving , from the client device, a value generated by the client device based in part on the set of cryptographic parameters; generating , using the received value and at least some of the set of cryptographic parameters, a premaster secret; generating a master secret using the premaster secret; generating , using the generated master secret, a set of one or more session keys to be used in the secure session for encrypting and decrypting communication between the client device and the first server ; receiving, from the client device over the secure session, a request for a resource of a domain of the second server , wherein the second server is an origin server, and wherein the request is encrypted; decrypting the request for the resource using at least one of the set of session keys; retrieving the requested resource from the second server ; generating a response that includes the retrieved resource; encrypting the generated response with at least one of the set of session keys; and transmitting the encrypted response to the client device . receiving a message from the client device that initiates a procedure to establish the secure session between the client device and the first server ; transmitting a digital certificate to the client device that includes a public key; generating a set of cryptographic parameters; transmitting , to the second server , a message that includes the set of cryptographic parameters, wherein the second server has the private key that corresponds to the public key; receiving from the second server , a message that includes the set of cryptographic parameters that have been signed using the private key ; transmitting , to the client device , the set of cryptographic parameters that have been signed using the private key ; receiving , from the client device, a value generated by the client device based in part on the set of cryptographic parameters; generating , using the received value and at least some of the set of cryptographic parameters, a premaster secret; generating a master secret using the premaster secret; generating , using the generated master secret, a set of one or more session keys to be used in the secure session for encrypting and decrypting communication between the client device and the first server ; receiving, from the client device over the secure session, a request for a resource of a domain of the second server , wherein the second server is an origin server, and wherein the request is encrypted; decrypting the request for the resource using at least one of the set of session keys; retrieving the requested resource from the second server ; generating a response that includes the retrieved resource; encrypting the generated response with at least one of the set of session keys; and transmitting the encrypted response to the client device . <EOS>