<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><br><br><div dir="ltr"><div>___________________________</div>iDevice - please excuse typos.</div><div dir="ltr"><br><blockquote type="cite">On May 2, 2020, at 11:53 AM, Junxiao Shi <shijunxiao@email.arizona.edu> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div>Hi Lixia</div><div>It's great to get your answer, instead of telling me to shut up.<br></div><div><br></div><div>The root certificate does not need to be maintained. It lasts for several years.</div></div></div></blockquote>Unless someone is careless with the associated private key...<div><br><blockquote type="cite"><div dir="ltr"><div dir="ltr"><div>Current and historical root certificates can be seen here: <a href="https://named-data.net/ndn-testbed/" target="_blank">https://named-data.net/ndn-testbed/</a></div><div><br></div><div>Unretrievable root/site certificates will hinder the adoption of <i>certificate bundle</i>.<br></div><div><br></div><div>For replication, I proposed a manual replication method, and it was approved on 20160630 NFD call. However, it's still not deployed.</div><div><a href="https://lists.netsec.colostate.edu/mailman/private/operators/2020-May/001430.html" target="_blank">https://lists.netsec.colostate.edu/mailman/private/operators/2020-May/001430.html</a></div><div><br></div><div>Yours, Junxiao<br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, May 2, 2020 at 11:48 AM Lixia Zhang <<a href="mailto:lixia@cs.ucla.edu" target="_blank">lixia@cs.ucla.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><p style="text-align:center"><font color="red"><b>External Email</b><br></font></p>yes I believe the root cert should be published, and should be replicated in the repo of all testbed routers.<div><br><div><div><div>I think the question really is who is responsible for maintaining root cert (I do not know the current practice, but let me find out)</div><div><br></div><div>Lixia</div><div><br><blockquote type="cite"><div>On May 2, 2020, at 8:31 AM, Junxiao Shi via Nfd-dev <<a href="mailto:nfd-dev@lists.cs.ucla.edu" target="_blank">nfd-dev@lists.cs.ucla.edu</a>> wrote:</div><br><div><div dir="ltr"><div>Dear folks</div><div><br></div><div>I wonder whether the testbed root certificate should be published over NDN?</div><div>Which node(s) are responsible for publishing this certificate?<br></div><div><br></div><div>Yours, Junxiao<br></div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">---------- Forwarded message ---------<br>From: <b class="gmail_sendername" dir="auto">Junxiao Shi</b> <span dir="auto"><<a href="mailto:shijunxiao@email.arizona.edu" target="_blank">shijunxiao@email.arizona.edu</a>></span><br>Date: Sat, May 2, 2020 at 11:30 AM<br>Subject: Re: NDN Testbed Root certificate not published<br>To: <<a href="mailto:operators@lists.named-data.net" target="_blank">operators@lists.named-data.net</a>> <<a href="mailto:operators@lists.named-data.net" target="_blank">operators@lists.named-data.net</a>><br></div><br><br><div dir="ltr"><div dir="ltr">
Hi NDNOPS<div><br></div><div>I notice that the "NDN Testbed <span>Root</span>" <span>certificate</span> cannot be retrieved over NDN.</div><div><br></div><div>From <a href="https://named-data.net/ndnsec/ndn-testbed-root-v2.ndncert.txt" target="_blank">https://named-data.net/ndnsec/ndn-testbed-root-v2.ndncert.txt</a> I can see:</div><div><div><span>Certificate</span> name: <font face="monospace, monospace">/ndn/KEY/e%9D%7F%A5%C5%81%10%7D/ndn/%FD%00%00%01%60qJQ%9B</font></div></div><div><br></div><div>However, I cannot retrieve the <span>certificate</span> over NDN.</div><div>To rule out potential connectivity problems, I'm running the commands on Arizona router.</div><div><br></div><div><div><font face="monospace, monospace">shijunxiao@hobo:~$ <font color="#0000ff">ndnpeek -V</font></font></div><div><font face="monospace, monospace">ndnpeek 0.7-1-g7d14815</font></div><div><font face="monospace, monospace">shijunxiao@hobo:~$ <font color="#0000ff">ndnpeek -P
<font face="monospace, monospace">/ndn/KEY/e%9D%7F%A5%C5%81%10%7D/ndn/%FD%00%00%01%60qJQ%9B</font>
</font></font></div><div><font face="monospace, monospace">shijunxiao@hobo:~$ <font color="#0000ff">echo $?</font></font></div><div><font face="monospace, monospace">3</font></div><br></div><div>The second command sets CanBePrefix flag with <span style="font-family:monospace,monospace">-P</span>. There's no response to this Interest.</div><div>ndnpeek exit code is 3. In ndnpeek 0.7, this means InterestLifetime has timed out.</div><br><div><br></div><div>Although <span>root</span> CA <span>certificate</span> retrieval is not a prerequisite of verifying packets, I still think the <span>root</span> <span>certificate</span> should be available over NDN.</div><div><br></div><div>Yours, Junxiao</div>
</div><br></div></div></div></div></div></blockquote></div><br></div></div></div></div></blockquote></div></div>
<span>_______________________________________________</span><br><span>Nfd-dev mailing list</span><br><span>Nfd-dev@lists.cs.ucla.edu</span><br><span>http://www.lists.cs.ucla.edu/mailman/listinfo/nfd-dev</span><br></div></blockquote></div></body></html>