diff --git a/systemd/deploy-over-testbed.md b/systemd/deploy-over-testbed.md
new file mode 100644
index 0000000..81e1bc2
--- /dev/null
+++ b/systemd/deploy-over-testbed.md
@@ -0,0 +1,18 @@
+# Deploy NDNCERT v0.3 over testbed
+
+Three steps:
+
+* Deploy root CA `/ndn` by setting up the NDNCERT CA configuration and run NDNCERT service
+* At each site server, run NDNCERT client command line tools to get certificate issued by `/ndn` using the PIN code challenge, set up the CA configuration and run NDNCERT CA service.
+* Update the `/ndn`'s configuration file and restart the service.
+
+
+## Step 1
+
+```bash
+
+```
+
+## Step 2
+
+## Step 3
\ No newline at end of file
diff --git a/systemd/step-1-root-ca.sh b/systemd/step-1-root-ca.sh
new file mode 100644
index 0000000..26e7940
--- /dev/null
+++ b/systemd/step-1-root-ca.sh
@@ -0,0 +1,27 @@
+#! /bin/bash
+
+# compile and install ndncert
+git clone https://github.com/Zhiyi-Zhang/ndncert.git
+cd ndncert
+git checkout origin/v0.3
+./waf configure
+./waf install
+
+# set up systemd file for linux service
+sudo cp ./build/systemd/ndncert-server.service /etc/systemd/system/
+sudo chmod 644 /etc/systemd/system/ndncert-server.service
+
+# update CA configuration file
+echo -e "{\n\"ca-prefix\": \"/ndn\",\n\"ca-info\": \"NDN testbed root CA\",\n\"max-validity-period\": \"1296000\",\n\"max-suffix-length\": \"2\",\n\"supported-challenges\":\n[\n{ \"challenge\": \"pin\" }\n]\n}" > /usr/local/etc/ndncert/ca.conf
+
+# sudo HOME=/var/lib/ndn/ndncert-ca -u ndn ndnsec-keygen /ndn
+
+# prepare
+mkdir /var/lib/ndn/ndncert-ca
+chown ndn /var/lib/ndn/ndncert-ca
+
+# run the CA
+sudo systemctl start ndncert-server
+
+# check the status to make sure everything is correct
+sudo systemctl status ndncert-server
\ No newline at end of file
diff --git a/systemd/step-2-site-ca.sh b/systemd/step-2-site-ca.sh
new file mode 100644
index 0000000..f682536
--- /dev/null
+++ b/systemd/step-2-site-ca.sh
@@ -0,0 +1,2 @@
+#! /bin/bash
+