Systems and methods are described for authentication of tunneled connections. A method includes establishing a first connection (C.sub.IO) from an inner agent to an outer agent including making a first TCP connection from the inner agent to the outer agent, negotiating a first SSL/TLS session (SSLSession.sub.IO) between the inner agent and the outer agent over the first TCP connection and applying the second SSL/TLS session (SSLSession.sub.IO) between the inner agent and the outer agent over the first TCP connection; establishing a second connection (C.sub.CO) from a client and the outer agent including making a second TCP connection from the client to the outer agent, negotiating a second SSL/TLS session (SSLSession.sub.CO) between the client and the outer agent over the second TCP connection and applying the second SSL/TLS session (SSLSession.sub.CO) between the client and the outer agent over the second TCP connection; and then negotiating a third SSL/TLS session (SSLSession.sub.CI) between the client and the inner agent via both the first SSL/TLS session (SSLSession.sub.IO) and the second SSL/TLS session (SSLSession.sub.CO) and applying the third SSL/TLS session (SSLSession.sub.CI) between the client and the inner agent layered over both the first SSL/TLS session (SSLSession.sub.IO) and the second SSL/TLS session (SSLSession.sub.CO), wherein negotiating the second SSL/TLS session (SSLSession.sub.CO) includes verifying at the outer agent that the client possesses a certificate signed with a certificate associated with the inner agent.