diff --git a/src/management/nfd-command-options.cpp b/src/management/nfd-command-options.cpp
index f8141d3..97a1be8 100644
--- a/src/management/nfd-command-options.cpp
+++ b/src/management/nfd-command-options.cpp
@@ -21,6 +21,11 @@
 
 #include "nfd-command-options.hpp"
 
+#ifdef NDN_MANAGEMENT_NFD_COMMAND_OPTIONS_KEEP_DEPRECATED_SIGNING_PARAMS
+#include "../security/identity-certificate.hpp"
+#include "../security/signing-helpers.hpp"
+#endif // NDN_MANAGEMENT_NFD_COMMAND_OPTIONS_KEEP_DEPRECATED_SIGNING_PARAMS
+
 namespace ndn {
 namespace nfd {
 
@@ -30,7 +35,6 @@
 CommandOptions::CommandOptions()
   : m_timeout(DEFAULT_TIMEOUT)
   , m_prefix(DEFAULT_PREFIX)
-  , m_signingParamsKind(SIGNING_PARAMS_DEFAULT)
 {
 }
 
@@ -53,10 +57,54 @@
 }
 
 CommandOptions&
+CommandOptions::setSigningInfo(const security::SigningInfo& signingInfo)
+{
+  m_signingInfo = signingInfo;
+  return *this;
+}
+
+#ifdef NDN_MANAGEMENT_NFD_COMMAND_OPTIONS_KEEP_DEPRECATED_SIGNING_PARAMS
+
+CommandOptions::SigningParamsKind
+CommandOptions::getSigningParamsKind() const
+{
+  switch (m_signingInfo.getSignerType()) {
+  case security::SigningInfo::SIGNER_TYPE_NULL:
+    return SIGNING_PARAMS_DEFAULT;
+  case security::SigningInfo::SIGNER_TYPE_ID:
+    return SIGNING_PARAMS_IDENTITY;
+  case security::SigningInfo::SIGNER_TYPE_CERT:
+    return SIGNING_PARAMS_CERTIFICATE;
+  default:
+    throw std::out_of_range("SigningInfo::SignerType is not convertible to CommandOptions::SigningParamsKind");
+  }
+}
+
+const Name&
+CommandOptions::getSigningIdentity() const
+{
+  BOOST_ASSERT(m_signingInfo.getSignerType() == security::SigningInfo::SIGNER_TYPE_ID);
+  return m_signingInfo.getSignerName();
+}
+
+const Name&
+CommandOptions::getSigningCertificate() const
+{
+  BOOST_ASSERT(m_signingInfo.getSignerType() == security::SigningInfo::SIGNER_TYPE_CERT);
+  return m_signingInfo.getSignerName();
+}
+
+CommandOptions&
+CommandOptions::setSigningDefault()
+{
+  m_signingInfo = security::SigningInfo();
+  return *this;
+}
+
+CommandOptions&
 CommandOptions::setSigningIdentity(const Name& identityName)
 {
-  m_signingParamsKind = SIGNING_PARAMS_IDENTITY;
-  m_identity = identityName;
+  m_signingInfo = security::signingByIdentity(identityName);
   return *this;
 }
 
@@ -69,8 +117,7 @@
     throw std::invalid_argument("certificate is invalid");
   }
 
-  m_signingParamsKind = SIGNING_PARAMS_CERTIFICATE;
-  m_identity = certificateName;
+  m_signingInfo = security::signingByCertificate(certificateName);
   return *this;
 }
 
@@ -80,5 +127,7 @@
   return this->setSigningCertificate(certificate.getName());
 }
 
+#endif // NDN_MANAGEMENT_NFD_COMMAND_OPTIONS_KEEP_DEPRECATED_SIGNING_PARAMS
+
 } // namespace nfd
 } // namespace ndn
diff --git a/src/management/nfd-command-options.hpp b/src/management/nfd-command-options.hpp
index 54f744f..7d43c1d 100644
--- a/src/management/nfd-command-options.hpp
+++ b/src/management/nfd-command-options.hpp
@@ -22,9 +22,14 @@
 #ifndef NDN_MANAGEMENT_NFD_COMMAND_OPTIONS_HPP
 #define NDN_MANAGEMENT_NFD_COMMAND_OPTIONS_HPP
 
-#include "../security/identity-certificate.hpp"
+#include "../security/signing-info.hpp"
+
+#define NDN_MANAGEMENT_NFD_COMMAND_OPTIONS_KEEP_DEPRECATED_SIGNING_PARAMS
 
 namespace ndn {
+
+class IdentityCertificate;
+
 namespace nfd {
 
 /** \ingroup management
@@ -34,6 +39,11 @@
 class CommandOptions
 {
 public:
+  /** \brief constructs CommandOptions
+   *  \post getTimeout() == DEFAULT_TIMEOUT
+   *  \post getPrefix() == DEFAULT_PREFIX
+   *  \post getSigningInfo().getSignerType() == SIGNER_TYPE_NULL
+   */
   CommandOptions();
 
   /** \return command timeout
@@ -66,8 +76,24 @@
   CommandOptions&
   setPrefix(const Name& prefix);
 
+  /** \return signing parameters
+   */
+  const security::SigningInfo&
+  getSigningInfo() const
+  {
+    return m_signingInfo;
+  }
+
+  /** \brief sets signing parameters
+   *  \return self
+   */
+  CommandOptions&
+  setSigningInfo(const security::SigningInfo& signingInfo);
+
+#ifdef NDN_MANAGEMENT_NFD_COMMAND_OPTIONS_KEEP_DEPRECATED_SIGNING_PARAMS
 public: // signing parameters
-  /** \brief indicates the selection of signing parameters
+  /** \deprecated use getSigningInfo and setSigningInfo
+   *  \brief indicates the selection of signing parameters
    */
   enum SigningParamsKind {
     /** \brief picks the default signing identity and certificate
@@ -81,46 +107,36 @@
     SIGNING_PARAMS_CERTIFICATE
   };
 
-  /** \return selection of signing parameters
+  /** \deprecated use getSigningInfo and setSigningInfo
+   *  \return selection of signing parameters
    */
   SigningParamsKind
-  getSigningParamsKind() const
-  {
-    return m_signingParamsKind;
-  }
+  getSigningParamsKind() const;
 
-  /** \return identity Name
+  /** \deprecated use getSigningInfo and setSigningInfo
+   *  \return identity Name
    *  \pre getSigningParamsKind() == SIGNING_PARAMS_IDENTITY
    */
   const Name&
-  getSigningIdentity() const
-  {
-    BOOST_ASSERT(m_signingParamsKind == SIGNING_PARAMS_IDENTITY);
-    return m_identity;
-  }
+  getSigningIdentity() const;
 
-  /** \return certificate Name
+  /** \deprecated use getSigningInfo and setSigningInfo
+   *  \return certificate Name
    *  \pre getSigningParamsKind() == SIGNING_PARAMS_CERTIFICATE
    */
   const Name&
-  getSigningCertificate() const
-  {
-    BOOST_ASSERT(m_signingParamsKind == SIGNING_PARAMS_CERTIFICATE);
-    return m_identity;
-  }
+  getSigningCertificate() const;
 
-  /** \brief chooses to use default identity and certificate
+  /** \deprecated use getSigningInfo and setSigningInfo
+   *  \brief chooses to use default identity and certificate
    *  \post getSigningParamsKind() == SIGNING_PARAMS_DEFAULT
    *  \return self
    */
   CommandOptions&
-  setSigningDefault()
-  {
-    m_signingParamsKind = SIGNING_PARAMS_DEFAULT;
-    return *this;
-  }
+  setSigningDefault();
 
-  /** \brief chooses to use a specific identity and its default certificate
+  /** \deprecated use getSigningInfo and setSigningInfo
+   *  \brief chooses to use a specific identity and its default certificate
    *  \post getSigningParamsKind() == SIGNING_PARAMS_IDENTITY
    *  \post getIdentityName() == identityName
    *  \return self
@@ -128,22 +144,26 @@
   CommandOptions&
   setSigningIdentity(const Name& identityName);
 
-  /** \brief chooses to use a specific identity certificate
+  /** \deprecated use getSigningInfo and setSigningInfo
+   *  \brief chooses to use a specific identity certificate
    *  \param certificateName identity certificate Name
    *  \throw std::invalid_argument if certificateName is invalid
    *  \post getSigningParamsKind() == SIGNING_PARAMS_CERTIFICATE
-   *  \post getIdentityCertificate() is a copy of certificate
+   *  \post getSigningCertificate() == certificateName
    *  \return self
    */
   CommandOptions&
   setSigningCertificate(const Name& certificateName);
 
-  /** \brief chooses to use a specific identity certificate
+  /** \deprecated use getSigningInfo and setSigningInfo
+   *  \brief chooses to use a specific identity certificate
    *  \details This is equivalent to .setIdentityCertificate(certificate.getName())
    */
   CommandOptions&
   setSigningCertificate(const IdentityCertificate& certificate);
 
+#endif // NDN_MANAGEMENT_NFD_COMMAND_OPTIONS_KEEP_DEPRECATED_SIGNING_PARAMS
+
 public:
   /** \brief gives the default command timeout: 10000ms
    */
@@ -156,8 +176,7 @@
 private:
   time::milliseconds m_timeout;
   Name m_prefix;
-  SigningParamsKind m_signingParamsKind;
-  Name m_identity; // identityName or certificateName
+  security::SigningInfo m_signingInfo;
 };
 
 } // namespace nfd
diff --git a/src/management/nfd-controller.cpp b/src/management/nfd-controller.cpp
index 5f2f133..0284889 100644
--- a/src/management/nfd-controller.cpp
+++ b/src/management/nfd-controller.cpp
@@ -45,23 +45,7 @@
   Name requestName = command->getRequestName(options.getPrefix(), parameters);
   Interest interest(requestName);
   interest.setInterestLifetime(options.getTimeout());
-
-  switch (options.getSigningParamsKind()) {
-  case CommandOptions::SIGNING_PARAMS_DEFAULT:
-    m_keyChain.sign(interest);
-    break;
-  case CommandOptions::SIGNING_PARAMS_IDENTITY:
-    m_keyChain.sign(interest, security::SigningInfo(security::SigningInfo::SIGNER_TYPE_ID,
-                                                    options.getSigningIdentity()));
-    break;
-  case CommandOptions::SIGNING_PARAMS_CERTIFICATE:
-    m_keyChain.sign(interest, security::SigningInfo(security::SigningInfo::SIGNER_TYPE_CERT,
-                                                    options.getSigningCertificate()));
-    break;
-  default:
-    BOOST_ASSERT(false);
-    break;
-  }
+  m_keyChain.sign(interest, options.getSigningInfo());
 
   m_face.expressInterest(interest,
                          bind(&Controller::processCommandResponse, this, _2,