diff --git a/README.md b/README.md
index 2678ed0..de446f2 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,89 @@
 NFD - Named Data Networking Forwarding Daemon
-=============================================
+==============================================================
 
+## Default Paths
 
+This README uses `SYSCONFDIR` when referring to the default locations of
+various NFD configuration files.  By default, `SYSCONFDIR` is set to
+`/usr/local/etc`.  If you override `PREFIX`, then `SYSCONFDIR` will
+default to `PREFIX/etc`.
+
+You may override `SYSCONFDIR` and `PREFIX` by specifying their
+corresponding options during installation:
+
+    ./waf install --prefix <path/for/prefix> --sysconfdir <some/other/path>
+
+## Running and Configuring NFD
+
+NFD's runtime settings may be modified via configuration file.  After
+installation, a working sample configuration is provided at
+`SYSCONFDIR/ndn/nfd.conf.sample`.  At startup, NFD will attempt to
+read the default configuration file location:
+`SYSCONFDIR/ndn/nfd.conf`.
+
+You may also specify an alternative configuration file location
+by running NFD with:
+
+    nfd --config </path/to/nfd.conf>
+
+Once again, note that you may simply copy or rename the provided
+sample configuration and have an **almost** fully configured NFD.
+However, this NFD will be unable to add FIB entries or perform
+other typical operation tasks until you authorize an NDN certificate
+with the appropriate privileges.
+
+## Installing an NDN Certificate for Command Authentication
+
+Many NFD management protocols require signed commands to be processed
+(e.g. FIB modification, Face creation/destructions, etc.). You will
+need an NDN certificate to use any application that issues signed
+commands.
+
+If you do not already have NDN certificate, you can generate one with
+the following commands:
+
+**Generate and install a self-signed identity certificate**:
+
+    ndnsec-keygen /`whoami` | ndnsec-install-cert -
+
+Note that the argument to ndnsec-key will be the identity name of the
+new key (in this case, `/your-username`). Identity names are
+hierarchical NDN names and may have multiple components
+(e.g. `/ndn/ucla/edu/alice`).  You may create additional keys and
+identities as you see fit.
+
+**Dump the NDN certificate to a file**:
+
+The following commands assume that you have not modified
+`PREFIX` or `SYSCONFDIR` If you have, please substitute
+`/usr/local/etc` for the appropriate value (the overriden
+`SYSCONFDIR` or `PREFIX/etc` if you changed `PREFIX`).
+
+    sudo mkdir -p /usr/local/etc/ndn/keys
+    ndnsec-cert-dump -i /`whoami` > default.ndncert
+    sudo mv default.ndncert /usr/local/etc/ndn/keys/default.ndncert
+
+## Running NFD with Ethernet Face Support
+
+The ether configuration file section contains settings for Ethernet
+faces and channels.  These settings will **NOT** work without root or
+setting the appropriate permissions:
+
+    sudo setcap cap_net_raw,cap_net_admin=eip /full/path/nfd
+
+You may need to install a package to use setcap:
+
+**Ubuntu:**
+
+    sudo apt-get install libcap2-bin
+
+**Mac OS X:**
+
+    curl https://bugs.wireshark.org/bugzilla/attachment.cgi?id=3373 -o ChmodBPF.tar.gz
+    tar zxvf ChmodBPF.tar.gz
+    open ChmodBPF/Install\ ChmodBPF.app
+
+or manually:
+
+    sudo chgrp admin /dev/bpf*
+    sudo chmod g+rw /dev/bpf*
diff --git a/daemon/mgmt/command-validator.cpp b/daemon/mgmt/command-validator.cpp
index 9028ba2..fd8a124 100644
--- a/daemon/mgmt/command-validator.cpp
+++ b/daemon/mgmt/command-validator.cpp
@@ -8,6 +8,8 @@
 #include <ndn-cpp-dev/util/io.hpp>
 #include <ndn-cpp-dev/security/identity-certificate.hpp>
 
+#include <boost/filesystem.hpp>
+
 namespace nfd {
 
 NFD_LOG_INIT("CommandValidator");
@@ -26,7 +28,7 @@
 CommandValidator::setConfigFile(ConfigFile& configFile)
 {
   configFile.addSectionHandler("authorizations",
-                               bind(&CommandValidator::onConfig, this, _1, _2));
+                               bind(&CommandValidator::onConfig, this, _1, _2, _3));
 }
 
 static inline void
@@ -41,8 +43,11 @@
 
 void
 CommandValidator::onConfig(const ConfigSection& section,
-                           bool isDryRun)
+                           bool isDryRun,
+                           const std::string& filename)
 {
+  using namespace boost::filesystem;
+
   const ConfigSection EMPTY_SECTION;
 
   if (section.begin() == section.end())
@@ -54,14 +59,14 @@
   ConfigSection::const_iterator authIt;
   for (authIt = section.begin(); authIt != section.end(); authIt++)
     {
-      std::string keyfile;
+      std::string certfile;
       try
         {
-          keyfile = authIt->second.get<std::string>("keyfile");
+          certfile = authIt->second.get<std::string>("certfile");
         }
       catch (const std::runtime_error& e)
         {
-          std::string msg = "No keyfile specified";
+          std::string msg = "No certfile specified";
           if (!isDryRun)
             {
               throw ConfigFile::Error(msg);
@@ -70,11 +75,14 @@
           continue;
         }
 
+      path certfilePath = absolute(certfile, path(filename).parent_path());
+      NFD_LOG_DEBUG("generated certfile path: " << certfilePath.native());
+
       std::ifstream in;
-      in.open(keyfile.c_str());
+      in.open(certfilePath.c_str());
       if (!in.is_open())
         {
-          std::string msg = "Unable to open key file " + keyfile;
+          std::string msg = "Unable to open certificate file " + certfilePath.native();
           if (!isDryRun)
             {
               throw ConfigFile::Error(msg);
@@ -90,7 +98,7 @@
         }
       catch(const std::runtime_error& error)
         {
-          std::string msg = "Malformed key file " + keyfile;
+          std::string msg = "Malformed certificate file " + certfilePath.native();
           if (!isDryRun)
             {
               throw ConfigFile::Error(msg);
@@ -109,8 +117,8 @@
         }
       catch (const std::runtime_error& error)
         {
-          std::string msg = "No privileges section found for key file " +
-            keyfile + " (" + id->getPublicKeyName().toUri() + ")";
+          std::string msg = "No privileges section found for certificate file " +
+            certfile + " (" + id->getPublicKeyName().toUri() + ")";
           if (!isDryRun)
             {
               throw ConfigFile::Error(msg);
@@ -121,7 +129,8 @@
 
       if (privileges->begin() == privileges->end())
         {
-          NFD_LOG_WARN("No privileges specified for key file " << keyfile + " (" << id->getPublicKeyName().toUri() << ")");
+          NFD_LOG_WARN("No privileges specified for certificate file " << certfile
+                       << " (" << id->getPublicKeyName().toUri() << ")");
         }
 
       ConfigSection::const_iterator privIt;
@@ -131,7 +140,7 @@
           if (m_supportedPrivileges.find(privilegeName) != m_supportedPrivileges.end())
             {
               NFD_LOG_INFO("Giving privilege \"" << privilegeName
-                           << "\" to key " << id->getPublicKeyName());
+                           << "\" to identity " << id->getPublicKeyName());
               if (!isDryRun)
                 {
                   const std::string regex = "^<localhost><nfd><" + privilegeName + ">";
@@ -141,8 +150,8 @@
           else
             {
               // Invalid configuration
-              std::string msg = "Invalid privilege \"" + privilegeName + "\" for key file " +
-                keyfile + " (" + id->getPublicKeyName().toUri() + ")";
+              std::string msg = "Invalid privilege \"" + privilegeName + "\" for certificate file " +
+                certfile + " (" + id->getPublicKeyName().toUri() + ")";
               if (!isDryRun)
                 {
                   throw ConfigFile::Error(msg);
@@ -163,7 +172,7 @@
 {
   if (m_supportedPrivileges.find(privilege) != m_supportedPrivileges.end())
     {
-      throw CommandValidator::Error("Duplicated privivilege: " + privilege);
+      throw CommandValidator::Error("Duplicated privilege: " + privilege);
     }
   m_supportedPrivileges.insert(privilege);
 }
diff --git a/daemon/mgmt/command-validator.hpp b/daemon/mgmt/command-validator.hpp
index 466bb70..97c7c18 100644
--- a/daemon/mgmt/command-validator.hpp
+++ b/daemon/mgmt/command-validator.hpp
@@ -39,7 +39,7 @@
    * \throws ConfigFile::Error on parse error
    */
   void
-  onConfig(const ConfigSection& section, bool isDryRun);
+  onConfig(const ConfigSection& section, bool isDryRun, const std::string& filename);
 
   /**
    * \param privilege name of privilege to add
diff --git a/daemon/mgmt/config-file.cpp b/daemon/mgmt/config-file.cpp
index e5bbb9d..d0eddd5 100644
--- a/daemon/mgmt/config-file.cpp
+++ b/daemon/mgmt/config-file.cpp
@@ -20,7 +20,7 @@
 
 void
 ConfigFile::addSectionHandler(const std::string& sectionName,
-                              OnConfig subscriber)
+                              ConfigSectionHandler subscriber)
 {
   m_subscriptions[sectionName] = subscriber;
 }
@@ -90,8 +90,8 @@
       SubscriptionTable::iterator subscriberIt = m_subscriptions.find(sectionName);
       if (subscriberIt != m_subscriptions.end())
         {
-          OnConfig subscriber = subscriberIt->second;
-          subscriber(section, isDryRun);
+          ConfigSectionHandler subscriber = subscriberIt->second;
+          subscriber(section, isDryRun, filename);
         }
       else
         {
diff --git a/daemon/mgmt/config-file.hpp b/daemon/mgmt/config-file.hpp
index 2a94fac..15eca05 100644
--- a/daemon/mgmt/config-file.hpp
+++ b/daemon/mgmt/config-file.hpp
@@ -16,9 +16,9 @@
 typedef boost::property_tree::ptree ConfigSection;
 
 /// \brief callback for config file sections
-typedef function<void(const ConfigSection&, bool)> OnConfig;
+typedef function<void(const ConfigSection&, bool, const std::string&)> ConfigSectionHandler;
 
-class ConfigFile
+class ConfigFile : noncopyable
 {
 public:
 
@@ -37,7 +37,7 @@
   /// \brief setup notification of configuration file sections
   void
   addSectionHandler(const std::string& sectionName,
-                    OnConfig subscriber);
+                    ConfigSectionHandler subscriber);
 
 
   /**
@@ -75,7 +75,7 @@
 
 private:
 
-  typedef std::map<std::string, OnConfig> SubscriptionTable;
+  typedef std::map<std::string, ConfigSectionHandler> SubscriptionTable;
 
   SubscriptionTable m_subscriptions;
 
diff --git a/daemon/mgmt/face-manager.cpp b/daemon/mgmt/face-manager.cpp
index 6407237..237a914 100644
--- a/daemon/mgmt/face-manager.cpp
+++ b/daemon/mgmt/face-manager.cpp
@@ -87,12 +87,14 @@
 FaceManager::setConfigFile(ConfigFile& configFile)
 {
   configFile.addSectionHandler("face_system",
-                               bind(&FaceManager::onConfig, this, _1, _2));
+                               bind(&FaceManager::onConfig, this, _1, _2, _3));
 }
 
 
 void
-FaceManager::onConfig(const ConfigSection& configSection, bool isDryRun)
+FaceManager::onConfig(const ConfigSection& configSection,
+                      bool isDryRun,
+                      const std::string& filename)
 {
   bool hasSeenUnix = false;
   bool hasSeenTcp = false;
diff --git a/daemon/mgmt/face-manager.hpp b/daemon/mgmt/face-manager.hpp
index 4139152..8efb509 100644
--- a/daemon/mgmt/face-manager.hpp
+++ b/daemon/mgmt/face-manager.hpp
@@ -83,7 +83,7 @@
 
 private:
   void
-  onConfig(const ConfigSection& configSection, bool isDryRun);
+  onConfig(const ConfigSection& configSection, bool isDryRun, const std::string& filename);
 
   void
   processSectionUnix(const ConfigSection& configSection, bool isDryRun);
diff --git a/daemon/mgmt/fib-manager.cpp b/daemon/mgmt/fib-manager.cpp
index 4e1dbe7..0ffe333 100644
--- a/daemon/mgmt/fib-manager.cpp
+++ b/daemon/mgmt/fib-manager.cpp
@@ -214,10 +214,4 @@
     }
 }
 
-// void
-// FibManager::onConfig(ConfigFile::Node section, bool isDryRun)
-// {
-
-// }
-
 } // namespace nfd
diff --git a/nfd.conf.sample.in b/nfd.conf.sample.in
index c7710a1..c915202 100644
--- a/nfd.conf.sample.in
+++ b/nfd.conf.sample.in
@@ -1,26 +1,26 @@
-; the general section contains settings of nfd process
+; The general section contains settings of nfd process.
 ; general
 ; {
 ; }
 
-; the face_system section defines what faces and channels are created
+; The face_system section defines what faces and channels are created.
 face_system
 {
-  ; the unix section contains settings of UNIX stream faces and channels
+  ; The unix section contains settings of UNIX stream faces and channels.
   unix
   {
     listen yes ; set to 'no' to disable UNIX stream listener, default 'yes'
     path /var/run/nfd.sock ; UNIX stream listener path
   }
 
-  ; the tcp section contains settings of TCP faces and channels
+  ; The tcp section contains settings of TCP faces and channels.
   tcp
   {
     listen yes ; set to 'no' to disable TCP listener, default 'yes'
     port 6363 ; TCP listener port number
   }
 
-  ; the udp section contains settings of UDP faces and channels
+  ; The udp section contains settings of UDP faces and channels.
   udp
   {
     port 6363 ; UDP unicast port number
@@ -31,36 +31,95 @@
 
     ; Example multicast settings
     ; NFD creates one UDP multicast face per NIC
+
     ; mcast yes ; set to 'no' to disable UDP multicast, default 'yes'
     ; mcast_port 56363 ; UDP multicast port number
     ; mcast_group 224.0.23.170 ; UDP multicast group (IPv4 only)
   }
 
-  ; the ether section contains settings of Ethernet faces and channels
+  ; The ether section contains settings of Ethernet faces and channels.
+  ; These settings will NOT work without root or setting the appropriate
+  ; permissions:
+  ;
+  ;    sudo setcap cap_net_raw,cap_net_admin=eip /full/path/nfd
+  ;
+  ; You may need to install a package to use setcap:
+  ;
+  ; **Ubuntu:**
+  ;
+  ;    sudo apt-get install libcap2-bin
+  ;
+  ; **Mac OS X:**
+  ;
+  ;    curl https://bugs.wireshark.org/bugzilla/attachment.cgi?id=3373 -o ChmodBPF.tar.gz
+  ;    tar zxvf ChmodBPF.tar.gz
+  ;    open ChmodBPF/Install\ ChmodBPF.app
+  ;
+  ; or manually:
+  ;
+  ;    sudo chgrp admin /dev/bpf*
+  ;    sudo chmod g+rw /dev/bpf*
+
   ether
   {
     mcast no
-    ; Example multicast settings
-    ; NFD creates one Ethernet multicast face per NIC
-    ; mcast yes ; set to 'no' to disable Ethernet multicast, default 'yes'
-    ; mcast_group 01:00:5E:00:17:AA ; Ethernet multicast group
+
+  ;    Example multicast settings
+  ;    NFD creates one Ethernet multicast face per NIC
+  ;
+  ;    mcast yes ; set to 'no' to disable Ethernet multicast, default 'yes'
+  ;    mcast_group 01:00:5E:00:17:AA ; Ethernet multicast group
   }
 }
 
-; the authorizations section grants privileges to authorized keys
+; The authorizations section grants privileges to authorized keys.
 authorizations
 {
-  ; an authorize section grants privileges to a key
+  ; An authorize section grants privileges to a NDN certificate.
   authorize
   {
-    keyfile @SYSCONFDIR@/ndn/keys/default.pub ; public key file
-    privileges ; set of privileges granted to this public key
+    ; If you do not already have NDN certificate, you can generate
+    ; one with the following commands.
+    ;
+    ; 1. Generate and install a self-signed identity certificate:
+    ;
+    ;      ndnsec-keygen /`whoami` | ndnsec-install-cert -
+    ;
+    ; Note that the argument to ndnsec-key will be the identity name of the
+    ; new key (in this case, /your-username). Identities are hierarchical NDN
+    ; names and may have multiple components (e.g. `/ndn/ucla/edu/alice`).
+    ; You may create additional keys and identities as you see fit.
+    ;
+    ; 2. Dump the NDN certificate to a file:
+    ;
+    ;      sudo mkdir -p @SYSCONFDIR@/ndn/keys/
+    ;      ndnsec-cert-dump -i /`whoami` >  default.ndncert
+    ;      sudo mv default.ndncert @SYSCONFDIR@/ndn/keys/default.ndncert
+    ;
+    ; The "certfile" field below specifies the default key directory for
+    ; your machine. You may move your newly created key to the location it
+    ; specifies or path.
+
+    certfile keys/default.ndncert ; NDN identity certificate file
+    privileges ; set of privileges granted to this identity
     {
       control-header
       faces
       fib
-      ; stats
       strategy-choice
     }
   }
+
+  ; You may have multiple authorize sections that specify additional
+  ; certificates and their privileges.
+
+;  authorize
+;  {
+;    certfile keys/this_cert_does_not_exist.ndncert
+;    authorize
+;    privileges
+;    {
+;      faces
+;    }
+;  }
 }
diff --git a/tests/mgmt/command-validator.cpp b/tests/mgmt/command-validator.cpp
index 4e53322..3dcae24 100644
--- a/tests/mgmt/command-validator.cpp
+++ b/tests/mgmt/command-validator.cpp
@@ -24,11 +24,10 @@
 
 // authorizations
 // {
-//   ; an authorize section grants privileges to a key
 //   authorize
 //   {
-//     keyfile "tests/mgmt/key1.pub" ; public key file
-//     privileges ; set of privileges granted to this public key
+//     certfile "tests/mgmt/cert1.ndncert"
+//     privileges
 //     {
 //       fib
 //       stats
@@ -37,8 +36,8 @@
 
 //   authorize
 //   {
-//     keyfile "tests/mgmt/key2.pub" ; public key file
-//     privileges ; set of privileges granted to this public key
+//     certfile "tests/mgmt/cert2.ndncert"
+//     privileges
 //     {
 //       faces
 //     }
@@ -50,7 +49,7 @@
 "{\n"
 "  authorize\n"
 "  {\n"
-"    keyfile \"tests/mgmt/key1.pub\"\n"
+"    certfile \"tests/mgmt/cert1.ndncert\"\n"
 "    privileges\n"
 "    {\n"
 "      fib\n"
@@ -59,7 +58,7 @@
 "  }\n"
 "  authorize\n"
 "  {\n"
-"    keyfile \"tests/mgmt/key2.pub\"\n"
+"    certfile \"tests/mgmt/cert2.ndncert\"\n"
 "    privileges\n"
 "    {\n"
 "      faces\n"
@@ -67,6 +66,9 @@
 "  }\n"
   "}\n";
 
+const boost::filesystem::path CONFIG_PATH =
+  boost::filesystem::current_path() /= std::string("unit-test-nfd.conf");
+
 class CommandValidatorTester
 {
 public:
@@ -170,17 +172,17 @@
   TwoValidatorFixture()
   {
     m_tester1.generateIdentity("/test/CommandValidator/TwoKeys/id1");
-    m_tester1.saveIdentityToFile("tests/mgmt/key1.pub");
+    m_tester1.saveIdentityToFile("tests/mgmt/cert1.ndncert");
 
     m_tester2.generateIdentity("/test/CommandValidator/TwoKeys/id2");
-    m_tester2.saveIdentityToFile("tests/mgmt/key2.pub");
+    m_tester2.saveIdentityToFile("tests/mgmt/cert2.ndncert");
   }
 
   ~TwoValidatorFixture()
   {
     boost::system::error_code error;
-    boost::filesystem::remove("tests/mgmt/key1.pub", error);
-    boost::filesystem::remove("tests/mgmt/key2.pub", error);
+    boost::filesystem::remove("tests/mgmt/cert1.ndncert", error);
+    boost::filesystem::remove("tests/mgmt/cert2.ndncert", error);
   }
 
 protected:
@@ -205,9 +207,9 @@
   validator.addSupportedPrivilege("fib");
   validator.addSupportedPrivilege("stats");
 
-  config.addSectionHandler("authorizations",
-                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
-  config.parse(CONFIG, false, "dummy-config");
+  validator.setConfigFile(config);
+
+  config.parse(CONFIG, false, CONFIG_PATH.native());
 
   validator.validate(*fibCommand,
                      bind(&CommandValidatorTester::onValidated, boost::ref(m_tester1), _1),
@@ -229,7 +231,7 @@
   BOOST_REQUIRE(m_tester2.commandValidated());
   m_tester2.resetValidation();
 
-  // use key2 for fib command (authorized for key1 only)
+  // use cert2 for fib command (authorized for cert1 only)
   shared_ptr<Interest> unauthorizedFibCommand = make_shared<Interest>("/localhost/nfd/fib/insert");
   generator.generateWithIdentity(*unauthorizedFibCommand, m_tester2.getIdentityName());
 
@@ -244,11 +246,11 @@
 {
   CommandValidatorTester tester1;
   tester1.generateIdentity("/test/CommandValidator/TwoKeys/id1");
-  tester1.saveIdentityToFile("tests/mgmt/key1.pub");
+  tester1.saveIdentityToFile("tests/mgmt/cert1.ndncert");
 
   CommandValidatorTester tester2;
   tester2.generateIdentity("/test/CommandValidator/TwoKeys/id2");
-  tester2.saveIdentityToFile("tests/mgmt/key2.pub");
+  tester2.saveIdentityToFile("tests/mgmt/cert2.ndncert");
 
   shared_ptr<Interest> fibCommand = make_shared<Interest>("/localhost/nfd/fib/insert");
   shared_ptr<Interest> statsCommand = make_shared<Interest>("/localhost/nfd/stats/dosomething");
@@ -265,9 +267,9 @@
   validator.addSupportedPrivilege("fib");
   validator.addSupportedPrivilege("stats");
 
-  config.addSectionHandler("authorizations",
-                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
-  config.parse(CONFIG, true, "dummy-config");
+  validator.setConfigFile(config);
+
+  config.parse(CONFIG, true, CONFIG_PATH.native());
 
   validator.validate(*fibCommand,
                      bind(&CommandValidatorTester::onValidated, boost::ref(m_tester1), _1),
@@ -289,7 +291,7 @@
   BOOST_REQUIRE(m_tester2.commandValidationFailed());
   m_tester2.resetValidation();
 
-  // use key2 for fib command (authorized for key1 only)
+  // use cert2 for fib command (authorized for cert1 only)
   shared_ptr<Interest> unauthorizedFibCommand = make_shared<Interest>("/localhost/nfd/fib/insert");
   generator.generateWithIdentity(*unauthorizedFibCommand, m_tester2.getIdentityName());
 
@@ -310,9 +312,8 @@
   ConfigFile config;
   CommandValidator validator;
 
-  config.addSectionHandler("authorizations",
-                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
-  BOOST_CHECK_THROW(config.parse(NO_AUTHORIZE_CONFIG, false, "dummy-config"), ConfigFile::Error);
+  validator.setConfigFile(config);
+  BOOST_CHECK_THROW(config.parse(NO_AUTHORIZE_CONFIG, false, CONFIG_PATH.native()), ConfigFile::Error);
 }
 
 BOOST_AUTO_TEST_CASE(NoPrivilegesSections)
@@ -322,26 +323,26 @@
     "{\n"
     "  authorize\n"
     "  {\n"
-    "    keyfile \"tests/mgmt/key1.pub\"\n"
+    "    certfile \"tests/mgmt/cert1.ndncert\"\n"
     "  }\n"
     "}\n";
 
   ConfigFile config;
   CommandValidator validator;
 
-  config.addSectionHandler("authorizations",
-                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
-  BOOST_CHECK_THROW(config.parse(NO_PRIVILEGES_CONFIG, false, "dummy-config"), ConfigFile::Error);
+  validator.setConfigFile(config);
+
+  BOOST_CHECK_THROW(config.parse(NO_PRIVILEGES_CONFIG, false, CONFIG_PATH.native()), ConfigFile::Error);
 }
 
-BOOST_AUTO_TEST_CASE(InvalidKeyFile)
+BOOST_AUTO_TEST_CASE(InvalidCertfile)
 {
-  const std::string INVALID_KEY_CONFIG =
+  const std::string INVALID_CERT_CONFIG =
     "authorizations\n"
     "{\n"
     "  authorize\n"
     "  {\n"
-    "    keyfile \"tests/mgmt/notakeyfile.pub\"\n"
+    "    certfile \"tests/mgmt/notacertfile.ndncert\"\n"
     "    privileges\n"
     "    {\n"
     "      fib\n"
@@ -353,14 +354,13 @@
   ConfigFile config;
   CommandValidator validator;
 
-  config.addSectionHandler("authorizations",
-                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
-  BOOST_CHECK_THROW(config.parse(INVALID_KEY_CONFIG, false, "dummy-config"), ConfigFile::Error);
+  validator.setConfigFile(config);
+  BOOST_CHECK_THROW(config.parse(INVALID_CERT_CONFIG, false, CONFIG_PATH.native()), ConfigFile::Error);
 }
 
-BOOST_AUTO_TEST_CASE(NoKeyFile)
+BOOST_AUTO_TEST_CASE(NoCertfile)
 {
-  const std::string NO_KEY_CONFIG =
+  const std::string NO_CERT_CONFIG =
     "authorizations\n"
     "{\n"
     "  authorize\n"
@@ -377,19 +377,18 @@
   ConfigFile config;
   CommandValidator validator;
 
-  config.addSectionHandler("authorizations",
-                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
-  BOOST_CHECK_THROW(config.parse(NO_KEY_CONFIG, false, "dummy-config"), ConfigFile::Error);
+  validator.setConfigFile(config);
+  BOOST_CHECK_THROW(config.parse(NO_CERT_CONFIG, false, CONFIG_PATH.native()), ConfigFile::Error);
 }
 
-BOOST_AUTO_TEST_CASE(MalformedKey)
+BOOST_AUTO_TEST_CASE(MalformedCert)
 {
-    const std::string MALFORMED_KEY_CONFIG =
+    const std::string MALFORMED_CERT_CONFIG =
     "authorizations\n"
     "{\n"
     "  authorize\n"
     "  {\n"
-    "    keyfile \"tests/mgmt/malformedkey.pub\"\n"
+    "    certfile \"tests/mgmt/malformed.ndncert\"\n"
     "    privileges\n"
     "    {\n"
     "      fib\n"
@@ -402,9 +401,8 @@
   ConfigFile config;
   CommandValidator validator;
 
-  config.addSectionHandler("authorizations",
-                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
-  BOOST_CHECK_THROW(config.parse(MALFORMED_KEY_CONFIG, false, "dummy-config"), ConfigFile::Error);
+  validator.setConfigFile(config);
+  BOOST_CHECK_THROW(config.parse(MALFORMED_CERT_CONFIG, false, CONFIG_PATH.native()), ConfigFile::Error);
 }
 
 bool
@@ -429,9 +427,8 @@
   ConfigFile config;
   CommandValidator validator;
 
-  config.addSectionHandler("authorizations",
-                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
-  BOOST_CHECK_EXCEPTION(config.parse(NO_AUTHORIZE_CONFIG, true, "dummy-config"),
+  validator.setConfigFile(config);
+  BOOST_CHECK_EXCEPTION(config.parse(NO_AUTHORIZE_CONFIG, true, CONFIG_PATH.native()),
                         ConfigFile::Error,
                         bind(&validateErrorMessage,
                              "No authorize sections found", _1));
@@ -444,47 +441,40 @@
     "{\n"
     "  authorize\n"
     "  {\n"
-    "    keyfile \"tests/mgmt/key1.pub\"\n"
+    "    certfile \"tests/mgmt/cert1.ndncert\"\n"
     "  }\n"
     "  authorize\n"
     "  {\n"
-    "    keyfile \"tests/mgmt/key2.pub\"\n"
+    "    certfile \"tests/mgmt/cert2.ndncert\"\n"
     "  }\n"
     "}\n";
 
-  // CommandValidatorTester tester1;
-  // tester1.generateIdentity("/tests/CommandValidator/TwoKeys/id1");
-  // tester1.saveIdentityToFile("tests/mgmt/key1.pub");
-
-  // CommandValidatorTester tester2;
-  // tester2.generateIdentity("/tests/CommandValidator/TwoKeys/id2");
-  // tester2.saveIdentityToFile("tests/mgmt/key2.pub");
-
   ConfigFile config;
   CommandValidator validator;
 
-  config.addSectionHandler("authorizations",
-                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
+  validator.setConfigFile(config);
 
   std::stringstream expectedError;
-  expectedError << "No privileges section found for key file tests/mgmt/key1.pub "
+  expectedError << "No privileges section found for certificate file tests/mgmt/cert1.ndncert "
                 << "(" << m_tester1.getPublicKeyName().toUri() << ")\n"
-                << "No privileges section found for key file tests/mgmt/key2.pub "
+                << "No privileges section found for certificate file tests/mgmt/cert2.ndncert "
                 << "(" << m_tester2.getPublicKeyName().toUri() << ")";
 
-  BOOST_CHECK_EXCEPTION(config.parse(NO_PRIVILEGES_CONFIG, true, "dummy-config"),
+  BOOST_CHECK_EXCEPTION(config.parse(NO_PRIVILEGES_CONFIG, true, CONFIG_PATH.native()),
                         ConfigFile::Error,
                         bind(&validateErrorMessage, expectedError.str(), _1));
 }
 
-BOOST_AUTO_TEST_CASE(InvalidKeyFileDryRun)
+BOOST_AUTO_TEST_CASE(InvalidCertfileDryRun)
 {
+  using namespace boost::filesystem;
+
   const std::string INVALID_KEY_CONFIG =
     "authorizations\n"
     "{\n"
     "  authorize\n"
     "  {\n"
-    "    keyfile \"tests/mgmt/notakeyfile.pub\"\n"
+    "    certfile \"tests/mgmt/notacertfile.ndncert\"\n"
     "    privileges\n"
     "    {\n"
     "      fib\n"
@@ -493,7 +483,7 @@
     "  }\n"
     "  authorize\n"
     "  {\n"
-    "    keyfile \"tests/mgmt/stillnotakeyfile.pub\"\n"
+    "    certfile \"tests/mgmt/stillnotacertfile.ndncert\"\n"
     "    privileges\n"
     "    {\n"
     "    }\n"
@@ -503,19 +493,22 @@
   ConfigFile config;
   CommandValidator validator;
 
-  config.addSectionHandler("authorizations",
-                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
+  validator.setConfigFile(config);
 
-  BOOST_CHECK_EXCEPTION(config.parse(INVALID_KEY_CONFIG, true, "dummy-config"),
+  std::stringstream error;
+  error << "Unable to open certificate file "
+        << absolute("tests/mgmt/notacertfile.ndncert").native() << "\n"
+        << "Unable to open certificate file "
+        << absolute("tests/mgmt/stillnotacertfile.ndncert").native();
+
+  BOOST_CHECK_EXCEPTION(config.parse(INVALID_KEY_CONFIG, true, CONFIG_PATH.native()),
                         ConfigFile::Error,
-                        bind(&validateErrorMessage,
-                             "Unable to open key file tests/mgmt/notakeyfile.pub\n"
-                             "Unable to open key file tests/mgmt/stillnotakeyfile.pub", _1));
+                        bind(&validateErrorMessage, error.str(), _1));
 }
 
-BOOST_AUTO_TEST_CASE(NoKeyFileDryRun)
+BOOST_AUTO_TEST_CASE(NoCertfileDryRun)
 {
-  const std::string NO_KEY_CONFIG =
+  const std::string NO_CERT_CONFIG =
     "authorizations\n"
     "{\n"
     "  authorize\n"
@@ -535,23 +528,24 @@
   ConfigFile config;
   CommandValidator validator;
 
-  config.addSectionHandler("authorizations",
-                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
-  BOOST_CHECK_EXCEPTION(config.parse(NO_KEY_CONFIG, true, "dummy-config"),
+  validator.setConfigFile(config);
+  BOOST_CHECK_EXCEPTION(config.parse(NO_CERT_CONFIG, true, CONFIG_PATH.native()),
                         ConfigFile::Error,
                         bind(&validateErrorMessage,
-                             "No keyfile specified\n"
-                             "No keyfile specified", _1));
+                             "No certfile specified\n"
+                             "No certfile specified", _1));
 }
 
-BOOST_AUTO_TEST_CASE(MalformedKeyDryRun)
+BOOST_AUTO_TEST_CASE(MalformedCertDryRun)
 {
-    const std::string MALFORMED_KEY_CONFIG =
+  using namespace boost::filesystem;
+
+  const std::string MALFORMED_CERT_CONFIG =
     "authorizations\n"
     "{\n"
     "  authorize\n"
     "  {\n"
-    "    keyfile \"tests/mgmt/malformedkey.pub\"\n"
+    "    certfile \"tests/mgmt/malformed.ndncert\"\n"
     "    privileges\n"
     "    {\n"
     "      fib\n"
@@ -560,7 +554,7 @@
     "  }\n"
     "  authorize\n"
     "  {\n"
-    "    keyfile \"tests/mgmt/malformedkey.pub\"\n"
+    "    certfile \"tests/mgmt/malformed.ndncert\"\n"
     "  }\n"
     "}\n";
 
@@ -568,13 +562,17 @@
   ConfigFile config;
   CommandValidator validator;
 
-  config.addSectionHandler("authorizations",
-                           bind(&CommandValidator::onConfig, boost::ref(validator), _1, _2));
-  BOOST_CHECK_EXCEPTION(config.parse(MALFORMED_KEY_CONFIG, true, "dummy-config"),
+  validator.setConfigFile(config);
+
+  std::stringstream error;
+  error << "Malformed certificate file "
+        << absolute("tests/mgmt/malformed.ndncert").native() << "\n"
+        << "Malformed certificate file "
+        << absolute("tests/mgmt/malformed.ndncert").native();
+
+  BOOST_CHECK_EXCEPTION(config.parse(MALFORMED_CERT_CONFIG, true, CONFIG_PATH.native()),
                         ConfigFile::Error,
-                        bind(&validateErrorMessage,
-                             "Malformed key file tests/mgmt/malformedkey.pub\n"
-                             "Malformed key file tests/mgmt/malformedkey.pub", _1));
+                        bind(&validateErrorMessage, error.str(), _1));
 }
 
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/tests/mgmt/malformedkey.pub b/tests/mgmt/malformed.ndncert
similarity index 100%
rename from tests/mgmt/malformedkey.pub
rename to tests/mgmt/malformed.ndncert