A method and system for single session sign-on across multiple content servers using public/private key cryptography. Session certificates are issued by an authentication authority and stored or held in volatile memory by a browser. Session certificates are used by browsers to obtain session credentials from a session authority and stored or held in volatile memory by the browser. Use of public and private keys supports authentication and non-repudiation, and eliminates some of the disadvantages of permanent certificates and PKI.