diff --git a/src/face.hpp b/src/face.hpp
index 9f11b0a..d95d04a 100644
--- a/src/face.hpp
+++ b/src/face.hpp
@@ -251,6 +251,10 @@
    *
    * @return Opaque registered prefix ID which can be used with unsetInterestFilter or
    *         removeRegisteredPrefix
+   *
+   * @note IdentityCertificate() creates a certificate with an empty name, which is an invalid
+   *       certificate.  A valid IdentityCertificate has at least 4 name components, as it follows
+   *       `<...>/KEY/<...>/<key-id>/ID-CERT/<version>` naming model.
    */
   const RegisteredPrefixId*
   setInterestFilter(const InterestFilter& interestFilter,
@@ -280,6 +284,10 @@
    *
    * @return Opaque registered prefix ID which can be used with unsetInterestFilter or
    *         removeRegisteredPrefix
+   *
+   * @note IdentityCertificate() creates a certificate with an empty name, which is an invalid
+   *       certificate.  A valid IdentityCertificate has at least 4 name components, as it follows
+   *       `<...>/KEY/<...>/<key-id>/ID-CERT/<version>` naming model.
    */
   const RegisteredPrefixId*
   setInterestFilter(const InterestFilter& interestFilter,
@@ -375,6 +383,10 @@
    * @param flags       (optional) RIB flags (not used when direct FIB management is requested)
    *
    * @return The registered prefix ID which can be used with unregisterPrefix
+   *
+   * @note IdentityCertificate() creates a certificate with an empty name, which is an invalid
+   *       certificate.  A valid IdentityCertificate has at least 4 name components, as it follows
+   *       `<...>/KEY/<...>/<key-id>/ID-CERT/<version>` naming model.
    */
   const RegisteredPrefixId*
   registerPrefix(const Name& prefix,
diff --git a/src/management/nfd-controller.hpp b/src/management/nfd-controller.hpp
index ef82cac..f5eff7c 100644
--- a/src/management/nfd-controller.hpp
+++ b/src/management/nfd-controller.hpp
@@ -78,7 +78,12 @@
   }
 
   /** \brief start command execution
-   *  \param certificate the certificate used to sign request Interests
+   *  \param certificate the certificate used to sign request Interests.
+   *         If IdentityCertificate() is passed, the default signing certificate will be used.
+   *
+   *  \note IdentityCertificate() creates a certificate with an empty name, which is an
+   *        invalid certificate.  A valid IdentityCertificate has at least 4 name components,
+   *        as it follows `<...>/KEY/<...>/<key-id>/ID-CERT/<version>` naming model.
    */
   template<typename Command>
   void
@@ -88,10 +93,15 @@
         const IdentityCertificate& certificate,
         const time::milliseconds& timeout = getDefaultCommandTimeout())
   {
-    start<Command>(parameters, onSuccess, onFailure,
-      bind(static_cast<void(KeyChain::*)(Interest&,const Name&)>(&KeyChain::sign<Interest>),
-           &m_keyChain, _1, cref(certificate.getName())),
-      timeout);
+    if (certificate.getName().empty()) {
+      start<Command>(parameters, onSuccess, onFailure, timeout);
+    }
+    else {
+      start<Command>(parameters, onSuccess, onFailure,
+        bind(static_cast<void(KeyChain::*)(Interest&,const Name&)>(&KeyChain::sign<Interest>),
+             &m_keyChain, _1, cref(certificate.getName())),
+        timeout);
+    }
   }
 
   /** \brief start command execution