<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi Junxiao,<div class=""><br class=""></div><div class=""><div><blockquote type="cite" class=""><div class="">On Nov 19, 2014, at 11:23 AM, Junxiao Shi <<a href="mailto:shijunxiao@email.arizona.edu" class="">shijunxiao@email.arizona.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><p dir="ltr" class="">Hi Yingdi</p><p dir="ltr" class="">Suppose one wants to mirror the same trust model as testbed and ndncert website, how can he do that? What are the commands?</p></div></blockquote>I list the commands for the example below:<br class=""><blockquote type="cite" class=""><div class=""><p dir="ltr" class="">>> Specifically, what are the commands to:</p><p dir="ltr" class="">
>> generate a root certificate: /example/KEY/ksk-1/ID-CERT<br class=""></p></div></blockquote>$ ndnsec-keygen /example | ndnsec-cert-install -<br class=""><blockquote type="cite" class=""><div class=""><p dir="ltr" class="">
>> generate a site certificate and sign it by root certificate: /example/KEY/site1/ksk-2/ID-CERT<br class=""></p></div></blockquote>$ ndnsec-keygen /example/site1 > site1-cert.req</div><div>$ ndnsec-certgen -N /example/site1 -s /example site1-cert.req | ndnsec-cert-install -<br class=""><blockquote type="cite" class=""><div class=""><p dir="ltr" class="">
>> generate a user certificate and sign it by site certificate: /example/site1/KEY/user1/ksk-3/ID-CERT<br class=""></p></div></blockquote>$ ndnsec-keygen /example/site1/user1 > user1-cert.req</div><div>$ ndnsec-certgen -N /example/site1/user1 -s /example/site1 user1-cert.req | ndnsec-cert-install -<br class=""><blockquote type="cite" class=""><div class=""><p dir="ltr" class="">
>> publish root, site, user certificate in a repository or ndns system<br class=""></p></div></blockquote>This depends on the tools. I usually write a simple cert publishing tool or use PIB to publish certificates<br class=""><blockquote type="cite" class=""><p dir="ltr" class="">
>> generate a data signing certificate and sign it by user certificate: /example/site1/user1/KEY/dsk-4/ID-CERT</p></blockquote></div><div class="">For now, the command line tool disables dsk generation, but we could enable that if necessary. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Yingdi</div></div></body></html>