<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div><br>
</div>
<div>Shou,</div>
<div><br>
</div>
<div>You have to be careful to get all the names correct from command to command.</div>
Here is what we currently do on the Testbed for NLSR.
<div><br>
</div>
<div>Note that we generate a set of keys and certs specifically for NLSR, separate from</div>
<div>the other Testbed certs.</div>
<div><br>
</div>
<div>On ucla Node we generate a root cert for NLSR:</div>
<div>ucla> sudo su - nlsr -c 'export HOME=/var/lib/ndn/nlsr/; ndnsec-key-gen -n /ndn'</div>
<div>ucla> sudo su - nlsr -c 'export HOME=/var/lib/ndn/nlsr/; ndnsec-sign-req /ndn > /etc/ndn/nlsr/keys/root.cert'</div>
<div><br>
</div>
<div>On the WU node we generate a key:</div>
<div>
<div>wu> sudo su - nlsr -c 'export HOME=/var/lib/ndn/nlsr/; ndnsec-key-gen -n /ndn/edu/wustl > ~nlsr/unsigned_site.cert'</div>
<div><br>
</div>
<div>We sign that key with the root cert on UCLA:</div>
<div>ucla> sudo su - nlsr -c 'export HOME=/var/lib/ndn/nlsr/; ndnsec-cert-gen -S 201410080000 -E 201510080000 -N "WU" -s /ndn -p /ndn/edu/wustl -r /home/nlsr/wu_unsigned_site.cert > /home/nlsr/wu_site.cert'</div>
<div><br>
</div>
<div>We copy the root cert and the signed wu cert back to WU node into /etc/ndn/nlsr/keys/root.cert and /etc/ndn/nlsr/keys/site.cert . Then continue …</div>
<div><br>
</div>
<div>Generate a key for WU operator, ndnops:</div>
<div>wu> sudo su - nlsr -c 'export HOME=/var/lib/ndn/nlsr/; ndnsec-key-gen -n /ndn/edu/wustl/%C1.Operator/ndnops > ~nlsr/unsigned_operator.cert’</div>
<div><br>
</div>
<div>Sign operator key with site cert named /ndn/edu/wustl</div>
<div>wu> sudo su - nlsr -c 'export HOME=/var/lib/ndn/nlsr/; ndnsec-cert-gen -S 201410080000 -E 201510080000 -N "WU Operator" -s /ndn/edu/wustl -p /ndn/edu/wustl/%C1.Operator/ndnops -r ~nlsr/unsigned_operator.cert > /etc/ndn/nlsr/keys/operator.cert’</div>
<div><br>
</div>
<div>Generate a router key for WU:</div>
<div>wu> sudo su - nlsr -c 'export HOME=/var/lib/ndn/nlsr/; ndnsec-key-gen -n /ndn/edu/wustl/%C1.Router/wundngw > ~nlsr/unsigned_router.cert’</div>
<div><br>
</div>
<div>Sign router key with operator cert named /ndn/edu/wustl/%C1.Operator/ndnops</div>
<div>wu> sudo su - nlsr -c 'export HOME=/var/lib/ndn/nlsr/; ndnsec-cert-gen -S 201410080000 -E 201510080000 -N "WU Router wundngw" -s /ndn/edu/wustl/%C1.Operator/ndnops -p /ndn/edu/wustl/%C1.Router/wundngw -r ~nlsr/unsigned_router.cert > /etc/ndn/nlsr/keys/router.cert'</div>
<div><br>
</div>
<div><br>
</div>
<div>So, in the end, on each node we end up with four cert files in /etc/ndn/nlsr/keys:</div>
<div>root.cert</div>
<div>site.cert</div>
<div>
<div>operator.cert</div>
<div>router.cert</div>
</div>
<div><br>
</div>
<div>Hope this helps.</div>
<div><br>
</div>
<div>John</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div>On Mar 2, 2015, at 6:28 AM, Shuo Chen <<a href="mailto:chenatu2006@gmail.com">chenatu2006@gmail.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div dir="ltr">Hi Yingdi,
<div><br>
</div>
<div>My question is that how to sign a cert with the root cert generated by another host.<br>
<div><br>
</div>
<div>Here is my security model</div>
<div><br>
</div>
<div>root---------site1----------router1</div>
<div> |-----------site2----------router2</div>
<div><br>
</div>
<div>I installed certificates of root, site1 and router1 in host1.</div>
<div>used ndnsec cert-dump to dump certificate of root in a file.</div>
<div>The I transferred this certificate file into another machine and used ndnsec cert-install to install the certificate.</div>
<div>All above works well.</div>
<div>Then </div>
<div>$ ndnsec-certgen -N /root/site2 -s /root site2-cert.req | ndnsec-cert-install -<br>
</div>
<div><br>
</div>
<div>It shows “ERROR: private key doesn't exists”</div>
<div><br>
</div>
<div>-----</div>
<div>Shuo Chen</div>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Thu, Nov 20, 2014 at 2:23 AM, Yingdi Yu <span dir="ltr">
<<a href="mailto:yingdi@cs.ucla.edu" target="_blank">yingdi@cs.ucla.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word"><br>
<div><span class="">
<blockquote type="cite">
<div>On Nov 19, 2014, at 10:13 AM, Junxiao Shi <<a href="mailto:shijunxiao@email.arizona.edu" target="_blank">shijunxiao@email.arizona.edu</a>> wrote:</div>
<br>
<div>
<div dir="ltr">Dear folks
<div><br>
</div>
<div>While we are able to request testbed certificates from ndncert website, when doing experiments, it's undesirable to request testbed certificates for all nodes.</div>
<div>Suppose someone wants to start a certificate chain from scratch, how could this be done?</div>
</div>
</div>
</blockquote>
<div><br>
</div>
</span>
<div>Just to clarify, the scenario you describe is a trust model for the ndncert only. For apps that just want to use simple trust model, it is not necessary to create so many keys.</div>
<span class=""><br>
<blockquote type="cite">
<div dir="ltr">
<div><br>
</div>
<div>Specifically, what are the commands to:</div>
<div>
<ol>
<li>generate a root certificate: /example/KEY/ksk-1/ID-CERT</li><li>generate a site certificate and sign it by root certificate: /example/KEY/site1/ksk-2/ID-CERT</li><li>generate a user certificate and sign it by site certificate: /example/site1/KEY/user1/ksk-3/ID-CERT</li><li>publish root, site, user certificate in a repository or ndns system</li><li>generate a data signing certificate and sign it by user certificate: /example/site1/user1/KEY/dsk-4/ID-CERT</li></ol>
</div>
<div><br>
</div>
<div>Another question is: why is testbed root certificate named /ndn/KEY/ksk-xxxx/ID-CERT, instead of /KEY/ndn/ksk-xxxx/ID-CERT</div>
</div>
</blockquote>
<div><br>
</div>
</span>Because the root of the testbed is "/ndn" rather than "/", and testbed publish its root cert under its own prefix.</div>
<span class="HOEnZb"><font color="#888888">
<div><br>
</div>
<div>Yingdi</div>
<br>
</font></span></div>
<br>
_______________________________________________<br>
Nfd-dev mailing list<br>
<a href="mailto:Nfd-dev@lists.cs.ucla.edu">Nfd-dev@lists.cs.ucla.edu</a><br>
<a href="http://www.lists.cs.ucla.edu/mailman/listinfo/nfd-dev" target="_blank">http://www.lists.cs.ucla.edu/mailman/listinfo/nfd-dev</a><br>
<br>
</blockquote>
</div>
<br>
</div>
_______________________________________________<br>
Nfd-dev mailing list<br>
<a href="mailto:Nfd-dev@lists.cs.ucla.edu">Nfd-dev@lists.cs.ucla.edu</a><br>
http://www.lists.cs.ucla.edu/mailman/listinfo/nfd-dev<br>
</blockquote>
</div>
<br>
</div>
</body>
</html>