diff --git a/tools/ndnsec/cert-dump.cpp b/tools/ndnsec/cert-dump.cpp
index 38d8ed5..d553822 100644
--- a/tools/ndnsec/cert-dump.cpp
+++ b/tools/ndnsec/cert-dump.cpp
@@ -95,7 +95,8 @@
     return 2;
   }
 
-  if (isIdentityName + isKeyName + isFileName > 1) {
+  int nIsNameOptions = isIdentityName + isKeyName + isFileName;
+  if (nIsNameOptions > 1) {
     std::cerr << "ERROR: at most one of '--identity', '--key', "
                  "or '--file' may be specified" << std::endl;
     return 2;
@@ -106,35 +107,20 @@
     return 2;
   }
 
-  security::v2::KeyChain keyChain;
-
   security::v2::Certificate certificate;
-  try {
-    if (isIdentityName) {
-      certificate = keyChain.getPib()
-                    .getIdentity(name)
-                    .getDefaultKey()
-                    .getDefaultCertificate();
-    }
-    else if (isKeyName) {
-      certificate = keyChain.getPib()
-                    .getIdentity(security::v2::extractIdentityFromKeyName(name))
-                    .getKey(name)
-                    .getDefaultCertificate();
-    }
-    else if (isFileName) {
+  if (isFileName) {
+    try {
       certificate = loadCertificate(name);
     }
-    else {
-      certificate = keyChain.getPib()
-                    .getIdentity(security::v2::extractIdentityFromCertName(name))
-                    .getKey(security::v2::extractKeyNameFromCertName(name))
-                    .getCertificate(name);
+    catch (const CannotLoadCertificate&) {
+      std::cerr << "ERROR: Cannot load the certificate from `" << name << "`" << std::endl;
+      return 1;
     }
   }
-  catch (const CannotLoadCertificate&) {
-    std::cerr << "ERROR: Cannot load the certificate from `" << name << "`" << std::endl;
-    return 1;
+  else {
+    security::v2::KeyChain keyChain;
+    certificate = getCertificateFromPib(keyChain.getPib(), name,
+                                        isIdentityName, isKeyName, nIsNameOptions == 0);
   }
 
   if (isPretty) {
diff --git a/tools/ndnsec/export.cpp b/tools/ndnsec/export.cpp
index 4429dd4..79bea3d 100644
--- a/tools/ndnsec/export.cpp
+++ b/tools/ndnsec/export.cpp
@@ -35,7 +35,10 @@
 {
   namespace po = boost::program_options;
 
-  Name identityName;
+  Name name;
+  bool isIdentityName = false;
+  bool isKeyName = false;
+  bool isCertName = false;
   std::string output;
   std::string password;
 
@@ -45,46 +48,69 @@
     OPENSSL_cleanse(&password.front(), password.size());
   } BOOST_SCOPE_EXIT_END
 
-  po::options_description description(
-    "Usage: ndnsec export [-h] [-o FILE] [-P PASSPHRASE] [-i] IDENTITY\n"
+  po::options_description visibleOptDesc(
+    "Usage: ndnsec export [-h] [-o FILE] [-P PASSPHRASE] [-i|-k|-c] NAME\n"
     "\n"
     "Options");
-  description.add_options()
+  visibleOptDesc.add_options()
     ("help,h", "produce help message")
-    ("identity,i", po::value<Name>(&identityName), "name of the identity to export")
+    ("identity,i", po::bool_switch(&isIdentityName),
+                   "treat the NAME argument as an identity name (e.g., /ndn/edu/ucla/alice)")
+    ("key,k",      po::bool_switch(&isKeyName),
+                   "treat the NAME argument as a key name (e.g., /ndn/edu/ucla/alice/KEY/1%5D%A7g%90%B2%CF%AA)")
+    ("cert,c",     po::bool_switch(&isCertName),
+                   "treat the NAME argument as a certificate name "
+                   "(e.g., /ndn/edu/ucla/alice/KEY/1%5D%A7g%90%B2%CF%AA/self/%FD%00%00%01r-%D3%DC%2A)")
     ("output,o",   po::value<std::string>(&output)->default_value("-"),
                    "output file, '-' for stdout (the default)")
     ("password,P", po::value<std::string>(&password),
                    "passphrase, will prompt if empty or not specified")
     ;
 
-  po::positional_options_description p;
-  p.add("identity", 1);
+  po::options_description hiddenOptDesc;
+  hiddenOptDesc.add_options()
+    ("name", po::value<Name>(&name));
+
+  po::options_description optDesc;
+  optDesc.add(visibleOptDesc).add(hiddenOptDesc);
+
+  po::positional_options_description optPos;
+  optPos.add("name", 1);
 
   po::variables_map vm;
   try {
-    po::store(po::command_line_parser(argc, argv).options(description).positional(p).run(), vm);
+    po::store(po::command_line_parser(argc, argv).options(optDesc).positional(optPos).run(), vm);
     po::notify(vm);
   }
   catch (const std::exception& e) {
     std::cerr << "ERROR: " << e.what() << "\n\n"
-              << description << std::endl;
+              << visibleOptDesc << std::endl;
     return 2;
   }
 
   if (vm.count("help") > 0) {
-    std::cout << description << std::endl;
+    std::cout << visibleOptDesc << std::endl;
     return 0;
   }
 
-  if (vm.count("identity") == 0) {
-    std::cerr << "ERROR: you must specify an identity" << std::endl;
+  if (vm.count("name") == 0) {
+    std::cerr << "ERROR: you must specify a name" << std::endl;
     return 2;
   }
 
-  security::v2::KeyChain keyChain;
+  int nIsNameOptions = isIdentityName + isKeyName + isCertName;
+  if (nIsNameOptions > 1) {
+    std::cerr << "ERROR: at most one of '--identity', '--key', "
+                 "or '--cert' may be specified" << std::endl;
+    return 2;
+  }
+  else if (nIsNameOptions == 0) {
+    isIdentityName = true;
+  }
 
-  auto id = keyChain.getPib().getIdentity(identityName);
+  security::v2::KeyChain keyChain;
+  auto cert = getCertificateFromPib(keyChain.getPib(), name,
+                                    isIdentityName, isKeyName, isCertName);
 
   if (password.empty()) {
     int count = 3;
@@ -97,9 +123,7 @@
     }
   }
 
-  // TODO: export all certificates, selected key pair, selected certificate
-  auto safeBag = keyChain.exportSafeBag(id.getDefaultKey().getDefaultCertificate(),
-                                        password.data(), password.size());
+  auto safeBag = keyChain.exportSafeBag(cert, password.data(), password.size());
 
   if (output == "-")
     io::save(*safeBag, std::cout);
diff --git a/tools/ndnsec/util.cpp b/tools/ndnsec/util.cpp
index cb35b52..c07b509 100644
--- a/tools/ndnsec/util.cpp
+++ b/tools/ndnsec/util.cpp
@@ -69,6 +69,28 @@
 }
 
 security::v2::Certificate
+getCertificateFromPib(const security::pib::Pib& pib, const Name& name,
+                      bool isIdentityName, bool isKeyName, bool isCertName)
+{
+  if (isIdentityName) {
+    return pib.getIdentity(name)
+           .getDefaultKey()
+           .getDefaultCertificate();
+  }
+  else if (isKeyName) {
+    return pib.getIdentity(security::v2::extractIdentityFromKeyName(name))
+           .getKey(name)
+           .getDefaultCertificate();
+  }
+  else if (isCertName) {
+    return pib.getIdentity(security::v2::extractIdentityFromCertName(name))
+           .getKey(security::v2::extractKeyNameFromCertName(name))
+           .getCertificate(name);
+  }
+  NDN_CXX_UNREACHABLE;
+}
+
+security::v2::Certificate
 loadCertificate(const std::string& fileName)
 {
   shared_ptr<security::v2::Certificate> cert;
diff --git a/tools/ndnsec/util.hpp b/tools/ndnsec/util.hpp
index 873f6b0..f069c34 100644
--- a/tools/ndnsec/util.hpp
+++ b/tools/ndnsec/util.hpp
@@ -33,6 +33,22 @@
 namespace ndn {
 namespace ndnsec {
 
+/**
+ * @brief Get certificate of given name from PIB.
+ * @param pib PIB instance, obtained from keyChain.getPib().
+ * @param name identity name, key name, or cert name.
+ * @param isIdentityName interpret @p name as identity name.
+ * @param isKeyName interpret @p name as key name.
+ * @param isCertName interpret @p name as certificate name.
+ * @pre exactly one of @p isIdentityName , @p isKeyName , @p isCertName must be true.
+ * @return a certificate.
+ * @throw std::invalid_argument name is invalid.
+ * @throw Pib::Error certificate does not exist.
+ */
+security::v2::Certificate
+getCertificateFromPib(const security::pib::Pib& pib, const Name& name,
+                      bool isIdentityName, bool isKeyName, bool isCertName);
+
 class CannotLoadCertificate : public std::runtime_error
 {
 public: