<div dir="ltr">Hi Jeff<div><br></div><div>The blog post promised below has been posted:</div><div>Issue Your Own NDN Certificates</div><div><a href="https://yoursunny.com/t/2016/ndncert/">https://yoursunny.com/t/2016/ndncert/</a></div><div><br></div><div>Yours, Junxiao<br><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jun 15, 2016 at 4:38 AM, Junxiao Shi <span dir="ltr"><<a href="mailto:shijunxiao@email.arizona.edu" target="_blank">shijunxiao@email.arizona.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi Jeff<div><br></div><div>As indicated in #<a href="http://redmine.named-data.net/issues/3568" target="_blank">3568</a> issue description, ndncert certificates will be required until #<a href="http://redmine.named-data.net/issues/2766" target="_blank">2766</a> and related functions are available.</div><div>#2766 itself is blocked by KeyChain refactoring, so it's unlikely to be available in next 6 months.</div><div><br></div><div>For now, you have to request a user certificate for each and every machine. You could use subaddressing (see <a href="https://tools.ietf.org/html/rfc5233" target="_blank">RFC5233</a>) to request certificates for each machine, such as <a href="mailto:peter%2Bfreeculture@remap.ucla.edu" target="_blank">peter+freeculture@remap.ucla.edu</a> <a href="mailto:peter%2Bconfbridge@remap.ucla.edu" target="_blank">peter+confbridge@remap.ucla.edu</a> , instead of creating whole new mailboxes.</div><div>Note that although you can request multiple user certificates with the same email address ( <a href="mailto:peter@remap.ucla.edu" target="_blank">peter@remap.ucla.edu</a> ) or copy the same user certificate onto multiple machines, doing so would cause those machines to register the same prefix on the router and rely on strategy to determine the correct route, which can worsen forwarding performance.</div><div><br></div><div>I do have a method to create delegated certificates like what Peter is trying to do, using only supported software.<br></div><div>The basic idea is to publish certificates on an always-on server, so that testbed router can retrieve it.</div><div>I'll write a blog post about this soon.</div><div><br></div><div>Yours, Junxiao<br><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jun 15, 2016 at 3:34 AM, Burke, Jeff <span dir="ltr"><<a href="mailto:jburke@remap.ucla.edu" target="_blank">jburke@remap.ucla.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">
<div bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri">How / when are we going to be able to delegate in this way?
<br>
We have many machines that are not directly associated with a user cert. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri">Jeff<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri"><u></u> <u></u></span></p>
<div style="border-style:solid none none;border-top-width:1pt;border-top-color:rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-family:Calibri;color:black">From: </span>
</b><span style="font-family:Calibri;color:black">Nfd-dev <<a href="mailto:nfd-dev-bounces@lists.cs.ucla.edu" target="_blank">nfd-dev-bounces@lists.cs.ucla.edu</a>> on behalf of Junxiao Shi <<a href="mailto:shijunxiao@email.arizona.edu" target="_blank">shijunxiao@email.arizona.edu</a>><br>
<b>Date: </b>Monday, June 13, 2016 at 9:53 PM<br>
<b>To: </b>"Gusev, Peter" <<a href="mailto:peter@remap.ucla.edu" target="_blank">peter@remap.ucla.edu</a>><br>
<b>Cc: </b>"<<a href="mailto:nfd-dev@lists.cs.ucla.edu" target="_blank">nfd-dev@lists.cs.ucla.edu</a>>" <<a href="mailto:nfd-dev@lists.cs.ucla.edu" target="_blank">nfd-dev@lists.cs.ucla.edu</a>><br>
<b>Subject: </b>Re: [Nfd-dev] [ndn] NDN Seminar: Practical Congestion Control for NDN<u></u><u></u></span></p>
</div><div><div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="border-style:none none none solid;border-left-width:4.5pt;border-left-color:rgb(181,196,223);padding:0in 0in 0in 4pt;margin-left:3.75pt;margin-right:0in">
<div>
<div>
<p>These sequence are incorrect. You cannot use any certificate other than the one directly requested from ndncert.</p></div></div></blockquote></div></div></div></div></blockquote></div></div></div></div></blockquote></div></div></div></div>