[adobrawy]

To protect against replay of the token associated with the certificate, simply challenge the client to sign the value specified by the server eg. random value+server ID.

However, it smells like self-made crypto.