<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Nov 19, 2014, at 10:13 AM, Junxiao Shi <<a href="mailto:shijunxiao@email.arizona.edu" class="">shijunxiao@email.arizona.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Dear folks<div class=""><br class=""></div><div class="">While we are able to request testbed certificates from ndncert website, when doing experiments, it's undesirable to request testbed certificates for all nodes.</div><div class="">Suppose someone wants to start a certificate chain from scratch, how could this be done?</div></div></div></blockquote><div><br class=""></div><div>Just to clarify, the scenario you describe is a trust model for the ndncert only. For apps that just want to use simple trust model, it is not necessary to create so many keys.</div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class=""><br class=""></div><div class="">Specifically, what are the commands to:</div><div class=""><ol class=""><li class="">generate a root certificate: /example/KEY/ksk-1/ID-CERT</li><li class="">generate a site certificate and sign it by root certificate: /example/KEY/site1/ksk-2/ID-CERT</li><li class="">generate a user certificate and sign it by site certificate: /example/site1/KEY/user1/ksk-3/ID-CERT</li><li class="">publish root, site, user certificate in a repository or ndns system</li><li class="">generate a data signing certificate and sign it by user certificate: /example/site1/user1/KEY/dsk-4/ID-CERT</li></ol></div><div class=""><br class=""></div><div class="">Another question is: why is testbed root certificate named /ndn/KEY/ksk-xxxx/ID-CERT, instead of /KEY/ndn/ksk-xxxx/ID-CERT</div></div></div></blockquote><div><br class=""></div>Because the root of the testbed is "/ndn" rather than "/", and testbed publish its root cert under its own prefix.</div><div><br class=""></div><div>Yingdi</div><br class=""></body></html>