diff --git a/src/security/certificate-cache-ttl.cpp b/src/security/certificate-cache-ttl.cpp
new file mode 100644
index 0000000..2ab13c9
--- /dev/null
+++ b/src/security/certificate-cache-ttl.cpp
@@ -0,0 +1,105 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2013-2014 Regents of the University of California.
+ *
+ * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
+ *
+ * ndn-cxx library is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU Lesser General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later version.
+ *
+ * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
+ *
+ * You should have received copies of the GNU General Public License and GNU Lesser
+ * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
+ *
+ * @author Yingdi Yu <http://irl.cs.ucla.edu/~yingdi/>
+ */
+
+#include "certificate-cache-ttl.hpp"
+
+namespace ndn {
+
+CertificateCacheTtl::CertificateCacheTtl(boost::asio::io_service& io,
+                                         const time::seconds& defaultTtl/* = time::seconds(3600)*/)
+  : m_defaultTtl(defaultTtl)
+  , m_io(io)
+  , m_scheduler(m_io)
+{
+}
+
+CertificateCacheTtl::~CertificateCacheTtl()
+{
+}
+
+void
+CertificateCacheTtl::insertCertificate(shared_ptr<const IdentityCertificate> certificate)
+{
+  m_io.dispatch([this, certificate] { this->insert(certificate); });
+}
+
+shared_ptr<const IdentityCertificate>
+CertificateCacheTtl::getCertificate(const Name& certificateName)
+{
+  Cache::iterator it = m_cache.find(certificateName);
+  if (it != m_cache.end())
+    return it->second.first;
+  else
+    return shared_ptr<IdentityCertificate>();
+}
+
+void
+CertificateCacheTtl::reset()
+{
+  m_io.dispatch([this] { this->removeAll(); });
+}
+
+size_t
+CertificateCacheTtl::getSize()
+{
+  return m_cache.size();
+}
+
+void
+CertificateCacheTtl::insert(shared_ptr<const IdentityCertificate> certificate)
+{
+  time::milliseconds expire = (certificate->getFreshnessPeriod() >= time::seconds::zero() ?
+                               certificate->getFreshnessPeriod() : m_defaultTtl);
+
+  Name index = certificate->getName().getPrefix(-1);
+
+  Cache::iterator it = m_cache.find(index);
+  if (it != m_cache.end())
+    m_scheduler.cancelEvent(it->second.second);
+
+  EventId eventId = m_scheduler.scheduleEvent(expire,
+                                              bind(&CertificateCacheTtl::remove,
+                                                   this, certificate->getName()));
+
+  m_cache[index] = std::make_pair(certificate, eventId);
+}
+
+void
+CertificateCacheTtl::remove(const Name& certificateName)
+{
+  Name name = certificateName.getPrefix(-1);
+  Cache::iterator it = m_cache.find(name);
+  if (it != m_cache.end())
+    m_cache.erase(it);
+}
+
+void
+CertificateCacheTtl::removeAll()
+{
+  for(Cache::iterator it = m_cache.begin(); it != m_cache.end(); it++)
+    m_scheduler.cancelEvent(it->second.second);
+
+  m_cache.clear();
+}
+
+} // namespace ndn
diff --git a/src/security/certificate-cache-ttl.hpp b/src/security/certificate-cache-ttl.hpp
index 650a9e7..55cbc5a 100644
--- a/src/security/certificate-cache-ttl.hpp
+++ b/src/security/certificate-cache-ttl.hpp
@@ -30,42 +30,42 @@
 
 namespace ndn {
 
+/**
+ * @brief Cache of validated certificates with freshness-based eviction policy
+ *
+ * Validated certificates will stay in cache for the duration of their freshness period.
+ * The lifetime of the certificate in cache can be extended by "re-inserting" it in the cache.
+ */
 class CertificateCacheTtl : public CertificateCache
 {
 public:
   explicit
   CertificateCacheTtl(boost::asio::io_service& io,
-                      const time::seconds& defaultTtl = time::seconds(3600))
-    : m_defaultTtl(defaultTtl)
-    , m_scheduler(io)
-  {
-  }
+                      const time::seconds& defaultTtl = time::seconds(3600));
 
   virtual
-  ~CertificateCacheTtl()
-  {
-  }
+  ~CertificateCacheTtl();
 
-  virtual inline void
+  virtual void
   insertCertificate(shared_ptr<const IdentityCertificate> certificate);
 
-  virtual inline shared_ptr<const IdentityCertificate>
+  virtual shared_ptr<const IdentityCertificate>
   getCertificate(const Name& certificateNameWithoutVersion);
 
-  virtual inline void
+  virtual void
   reset();
 
-  virtual inline size_t
+  virtual size_t
   getSize();
 
 private:
-  inline void
+  void
   insert(shared_ptr<const IdentityCertificate> certificate);
 
-  inline void
+  void
   remove(const Name& certificateName);
 
-  inline void
+  void
   removeAll();
 
 protected:
@@ -73,77 +73,10 @@
 
   time::seconds m_defaultTtl;
   Cache m_cache;
+  boost::asio::io_service& m_io;
   Scheduler m_scheduler;
 };
 
-inline void
-CertificateCacheTtl::insertCertificate(shared_ptr<const IdentityCertificate> certificate)
-{
-  m_scheduler.scheduleEvent(time::seconds(0),
-                            bind(&CertificateCacheTtl::insert, this, certificate));
-}
-
-inline shared_ptr<const IdentityCertificate>
-CertificateCacheTtl::getCertificate(const Name& certificateName)
-{
-  Cache::iterator it = m_cache.find(certificateName);
-  if (it != m_cache.end())
-    return it->second.first;
-  else
-    return shared_ptr<IdentityCertificate>();
-}
-
-inline void
-CertificateCacheTtl::reset()
-{
-  m_scheduler.scheduleEvent(time::seconds(0),
-                            bind(&CertificateCacheTtl::removeAll, this));
-}
-
-inline size_t
-CertificateCacheTtl::getSize()
-{
-  return m_cache.size();
-}
-
-inline void
-CertificateCacheTtl::insert(shared_ptr<const IdentityCertificate> certificate)
-{
-  time::milliseconds expire = (certificate->getFreshnessPeriod() >= time::seconds::zero() ?
-                               certificate->getFreshnessPeriod() : m_defaultTtl);
-
-  Name index = certificate->getName().getPrefix(-1);
-
-  Cache::iterator it = m_cache.find(index);
-  if (it != m_cache.end())
-    m_scheduler.cancelEvent(it->second.second);
-
-  EventId eventId = m_scheduler.scheduleEvent(expire,
-                                              bind(&CertificateCacheTtl::remove,
-                                                   this, certificate->getName()));
-
-  m_cache[index] = std::make_pair(certificate, eventId);
-}
-
-inline void
-CertificateCacheTtl::remove(const Name& certificateName)
-{
-  Name name = certificateName.getPrefix(-1);
-  Cache::iterator it = m_cache.find(name);
-  if (it != m_cache.end())
-    m_cache.erase(it);
-}
-
-inline void
-CertificateCacheTtl::removeAll()
-{
-  for(Cache::iterator it = m_cache.begin(); it != m_cache.end(); it++)
-    m_scheduler.cancelEvent(it->second.second);
-
-  m_cache.clear();
-}
-
-
 } // namespace ndn
 
-#endif //NDN_SECURITY_CERTIFICATE_CACHE_TTL_HPP
+#endif // NDN_SECURITY_CERTIFICATE_CACHE_TTL_HPP
diff --git a/src/security/certificate-cache.hpp b/src/security/certificate-cache.hpp
index 31296a0..42f3b88 100644
--- a/src/security/certificate-cache.hpp
+++ b/src/security/certificate-cache.hpp
@@ -29,7 +29,10 @@
 
 namespace ndn {
 
-class CertificateCache
+/**
+ * @brief Interface for the cache of validated certificates
+ */
+class CertificateCache : noncopyable
 {
 public:
   virtual
@@ -58,4 +61,4 @@
 
 } // namespace ndn
 
-#endif //NDN_SECURITY_CERTIFICATE_CACHE_HPP
+#endif // NDN_SECURITY_CERTIFICATE_CACHE_HPP
diff --git a/src/util/time-unit-test-clock.cpp b/src/util/time-unit-test-clock.cpp
index 73c30f7..7ed848d 100644
--- a/src/util/time-unit-test-clock.cpp
+++ b/src/util/time-unit-test-clock.cpp
@@ -20,10 +20,14 @@
  */
 
 #include "time-unit-test-clock.hpp"
+#include "monotonic_deadline_timer.hpp"
+#include <thread>
 
 namespace ndn {
 namespace time {
 
+const std::chrono::microseconds SLEEP_AFTER_TIME_CHANGE(2);
+
 template<class BaseClock>
 UnitTestClock<BaseClock>::UnitTestClock(const nanoseconds& startTime)
   : m_currentTime(startTime)
@@ -63,13 +67,31 @@
 UnitTestClock<BaseClock>::advance(const nanoseconds& duration)
 {
   m_currentTime += duration;
+
+  // On some platforms, boost::asio::io_service for deadline_timer (e.g., the one used in
+  // Scheduler) will call time_traits<>::now() and will "sleep" for
+  // time_traits<>::to_posix_time(duration) period before calling time_traits<>::now()
+  // again. (Note that such "sleep" will occur even if there is no actual waiting and
+  // program is calling io_service.poll().)
+  //
+  // As a result, in order for the clock advancement to be effective, we must sleep for a
+  // period greater than time_traits<>::to_posix_time().
+  //
+  // See also http://blog.think-async.com/2007/08/time-travel.html
+  BOOST_ASSERT(boost::posix_time::microseconds(SLEEP_AFTER_TIME_CHANGE.count()) >
+               boost::asio::time_traits<steady_clock>::to_posix_duration(duration));
+  std::this_thread::sleep_for(SLEEP_AFTER_TIME_CHANGE);
 }
 
 template<class BaseClock>
 void
 UnitTestClock<BaseClock>::setNow(const nanoseconds& timeSinceEpoch)
 {
+  BOOST_ASSERT(boost::posix_time::microseconds(SLEEP_AFTER_TIME_CHANGE.count()) >
+               boost::asio::time_traits<steady_clock>::to_posix_duration(timeSinceEpoch -
+                                                                         m_currentTime));
   m_currentTime = timeSinceEpoch;
+  std::this_thread::sleep_for(SLEEP_AFTER_TIME_CHANGE);
 }
 
 template