Short-lived certificate authority service

A method implemented at a computing device, the method comprising:

• receiving, by an authentication service executed at the computing device having a processor and memory and configured to issue tokens and certificates, a single request from a client over a network;
• issuing, by the authentication service executed at the computing device, a response to the single request utilizing an extended web service trust protocol, the extended web service trust protocol comprises a web service trust protocol for certificate requests that is extended with syntax which permits inclusion of the certificate in the response to the single request, and the single request includes:
• a token configured to be provided as proof of the client's identity to at least one service provider;
• and
• a certificate that is separate and distinct from the token, and when the certificate is received by the client, the certificate is used with another certificate received from a different client to establish secure peer-to-peer transactions between the client and the different client.

One or more computer readable media comprising computer executable instruction that when executed by a computer direct the computer to perform a method comprising:

• executing a messaging module to communicate with another computer;
• in response to executing the messaging module, generating a bundled request for a token and a short-lived certificate (SLC) using an extended web service trust protocol, wherein the extended web service trust protocol comprises a web service trust protocol for token requests that is extended with syntax that permits a request for an SLC, such that the extended web service trust protocol supports bundled requests for a token and an SLC;
• communicating the bundled request to an authentication service, wherein the bundled request is authenticated by the authentication service using client credentials;
• in response to the bundled request, receiving a particular token and a particular SLC, wherein the particular SLC is configured to establish a secure peer-to-peer communications channel;
• presenting the particular token as proof of identity at any of a plurality of service providers without needing additional authentication at said providers;
• using the particular SLC and an additional SLC received at the another computer to establish a secure peer-to-peer communications channel between the computer and the another computer without the authentication service validating the particular SLC received at the computer and the additional SLC received at the another computer;
• and
• sharing data with the another computer via the secure peer-to-peer communications channel.