<div dir="ltr">Hi Jeff<div><br></div><div>As indicated in #<a href="http://redmine.named-data.net/issues/3568">3568</a> issue description, ndncert certificates will be required until #<a href="http://redmine.named-data.net/issues/2766">2766</a> and related functions are available.</div><div>#2766 itself is blocked by KeyChain refactoring, so it's unlikely to be available in next 6 months.</div><div><br></div><div>For now, you have to request a user certificate for each and every machine. You could use subaddressing (see <a href="https://tools.ietf.org/html/rfc5233">RFC5233</a>) to request certificates for each machine, such as <a href="mailto:peter%2Bfreeculture@remap.ucla.edu">peter+freeculture@remap.ucla.edu</a> <a href="mailto:peter%2Bconfbridge@remap.ucla.edu">peter+confbridge@remap.ucla.edu</a> , instead of creating whole new mailboxes.</div><div>Note that although you can request multiple user certificates with the same email address ( <a href="mailto:peter@remap.ucla.edu">peter@remap.ucla.edu</a> ) or copy the same user certificate onto multiple machines, doing so would cause those machines to register the same prefix on the router and rely on strategy to determine the correct route, which can worsen forwarding performance.</div><div><br></div><div>I do have a method to create delegated certificates like what Peter is trying to do, using only supported software.<br></div><div>The basic idea is to publish certificates on an always-on server, so that testbed router can retrieve it.</div><div>I'll write a blog post about this soon.</div><div><br></div><div>Yours, Junxiao<br><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jun 15, 2016 at 3:34 AM, Burke, Jeff <span dir="ltr"><<a href="mailto:jburke@remap.ucla.edu" target="_blank">jburke@remap.ucla.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">How / when are we going to be able to delegate in this way?
<br>
We have many machines that are not directly associated with a user cert. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Jeff<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><u></u> <u></u></span></p>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-family:Calibri;color:black">From: </span>
</b><span style="font-family:Calibri;color:black">Nfd-dev <<a href="mailto:nfd-dev-bounces@lists.cs.ucla.edu" target="_blank">nfd-dev-bounces@lists.cs.ucla.edu</a>> on behalf of Junxiao Shi <<a href="mailto:shijunxiao@email.arizona.edu" target="_blank">shijunxiao@email.arizona.edu</a>><br>
<b>Date: </b>Monday, June 13, 2016 at 9:53 PM<br>
<b>To: </b>"Gusev, Peter" <<a href="mailto:peter@remap.ucla.edu" target="_blank">peter@remap.ucla.edu</a>><br>
<b>Cc: </b>"<<a href="mailto:nfd-dev@lists.cs.ucla.edu" target="_blank">nfd-dev@lists.cs.ucla.edu</a>>" <<a href="mailto:nfd-dev@lists.cs.ucla.edu" target="_blank">nfd-dev@lists.cs.ucla.edu</a>><br>
<b>Subject: </b>Re: [Nfd-dev] [ndn] NDN Seminar: Practical Congestion Control for NDN<u></u><u></u></span></p>
</div><div><div class="h5">
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="border:none;border-left:solid #b5c4df 4.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-right:0in">
<div>
<div>
<p>These sequence are incorrect. You cannot use any certificate other than the one directly requested from ndncert.<u></u><u></u></p>
<div>
<p class="MsoNormal">On Jun 13, 2016 12:22 PM, "Gusev, Peter" <<a href="mailto:peter@remap.ucla.edu" target="_blank">peter@remap.ucla.edu</a>> wrote:<u></u><u></u></p>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi Junxiao,<br>
<br>
I generated a cert request on freeculture like this:<br>
<br>
$ ndnsec-keygen /ndn/edu/ucla/remap/peter/freeculture > freeculture.pub<br>
<br>
Then, I signed it on my machine:<br>
<br>
$ ndnsec-certgen -N freeculture -p /ndn/edu/ucla/remap/peter -r freeculture.pub > freeculture.signed<br>
<br>
I sent freeculture.signed back to freeculture machine, as long as my certificate (previously dumped):<br>
<br>
$ ndnsec-cert-dump /ndn/edu/ucla/remap/peter > peter.cert<br>
<br>
Finally, I installed both certificates on freeculture machine:<br>
<br>
$ ndnsec-install-cert peter.cert<br>
$ ndnsec-install-cert freeculture.signed<br>
<br>
Both ended successfully. I then switched default identity to /ndn/edu/ucla/remap/peter/freeculture on freeculture machine:<br>
<br>
$ ndnsec set-default /ndn/edu/ucla/remap/peter/freeculture<br>
<br>
However, I don’t see connectivity to the testbed after running ndn-autoconfig.<span style="font-family:MingLiU"><br>
<br>
</span>Was the above sequence correct?<span style="font-family:MingLiU"><br>
<br>
</span>Thanks,<span style="font-family:MingLiU"><br>
<br>
</span>--<span style="font-family:MingLiU"><br>
</span>Peter Gusev<span style="font-family:MingLiU"><br></span></p></blockquote></div></div></div></blockquote></div></div></div></div></blockquote></div></div></div></div>