diff --git a/src/ca-module.cpp b/src/ca-module.cpp
index 1e4058c..edd61dc 100644
--- a/src/ca-module.cpp
+++ b/src/ca-module.cpp
@@ -92,7 +92,7 @@
 void
 CaModule::handleProbe(const Interest& request, const CaItem& caItem)
 {
-  // PROBE Naming Convention: /CA-prefix/_PROBE/<Probe Information>
+  // PROBE Naming Convention: /CA-prefix/CA/_PROBE/<Probe Information>
   _LOG_TRACE("Handle PROBE request");
 
   std::string identifier;
@@ -118,7 +118,7 @@
 void
 CaModule::handleNew(const Interest& request, const CaItem& caItem)
 {
-  // NEW Naming Convention: /CA-prefix/_NEW/<certificate-request>/[signature]
+  // NEW Naming Convention: /CA-prefix/CA/_NEW/<certificate-request>/[signature]
   _LOG_TRACE("Handle NEW request");
 
   security::v2::Certificate clientCert;
@@ -151,7 +151,7 @@
 void
 CaModule::handleSelect(const Interest& request, const CaItem& caItem)
 {
-  // SELECT Naming Convention: /CA-prefix/_SELECT/{Request-ID JSON}/<ChallengeID>/
+  // SELECT Naming Convention: /CA-prefix/CA/_SELECT/{Request-ID JSON}/<ChallengeID>/
   // {Param JSON}/[Signature components]
   _LOG_TRACE("Handle SELECT request");
 
@@ -198,7 +198,7 @@
 void
 CaModule::handleValidate(const Interest& request, const CaItem& caItem)
 {
-  // VALIDATE Naming Convention: /CA-prefix/_VALIDATE/{Request-ID JSON}/<ChallengeID>/
+  // VALIDATE Naming Convention: /CA-prefix/CA/_VALIDATE/{Request-ID JSON}/<ChallengeID>/
   // {Param JSON}/[Signature components]
   _LOG_TRACE("Handle VALIDATE request");
 
@@ -241,7 +241,7 @@
 void
 CaModule::handleStatus(const Interest& request, const CaItem& caItem)
 {
-  // STATUS Naming Convention: /CA-prefix/_STATUS/{Request-ID JSON}/[Signature components]
+  // STATUS Naming Convention: /CA-prefix/CA/_STATUS/{Request-ID JSON}/[Signature components]
   _LOG_TRACE("Handle STATUS request");
 
   CertificateRequest certRequest = getCertificateRequest(request, caItem.m_caName);
@@ -272,7 +272,7 @@
 void
 CaModule::handleDownload(const Interest& request, const CaItem& caItem)
 {
-  // DOWNLOAD Naming Convention: /CA-prefix/_DOWNLOAD/{Request-ID JSON}
+  // DOWNLOAD Naming Convention: /CA-prefix/CA/_DOWNLOAD/{Request-ID JSON}
   _LOG_TRACE("Handle DOWNLOAD request");
 
   JsonSection requestIdJson = jsonFromNameComponent(request.getName(), caItem.m_caName.size() + 2);
@@ -289,7 +289,7 @@
   Data result;
   result.setName(request.getName());
   result.setContent(signedCert.wireEncode());
-  m_keyChain.sign(result, signingWithSha256());
+  m_keyChain.sign(result, signingByCertificate(caItem.m_anchor));
   m_face.put(result);
 }
 
diff --git a/tools/ndncert-client.cpp b/tools/ndncert-client.cpp
index 97b03bb..86ff60f 100644
--- a/tools/ndncert-client.cpp
+++ b/tools/ndncert-client.cpp
@@ -46,10 +46,20 @@
   }
 
   void
-  validateCb(const shared_ptr<RequestState> state, int& nStep)
+  downloadCb(const shared_ptr<RequestState>& state, int& nStep)
+  {
+    _LOG_TRACE("Certificate has already been installed to local keychain");
+    return;
+  }
+
+  void
+  validateCb(const shared_ptr<RequestState>& state, int& nStep)
   {
     if (state->m_status == ChallengeModule::SUCCESS) {
       _LOG_TRACE("Certificate has already been issued");
+      client.requestDownload(state,
+                             bind(&ClientTool::downloadCb, this, _1, nStep),
+                             bind(&ClientTool::errorCb, this, _1));
       return;
     }
 
@@ -73,7 +83,7 @@
   }
 
   void
-  selectCb(const shared_ptr<RequestState> state, int& nStep)
+  selectCb(const shared_ptr<RequestState>& state, int& nStep)
   {
     auto challenge = ChallengeModule::createChallengeModule(state->m_challengeType);
     auto requirementList = challenge->getRequirementForValidate(state->m_status);
@@ -96,7 +106,7 @@
   }
 
   void
-  newCb(const shared_ptr<RequestState> state, int& nStep)
+  newCb(const shared_ptr<RequestState>& state, int& nStep)
   {
     std::cerr << "Step" << nStep++ << ": Please select one challenge from following types." << std::endl;
     for (auto item : state->m_challengeList) {
@@ -191,7 +201,7 @@
     std::cerr <<"Step" << nStep++ << ": Please type in the identity name" << std::endl;
     std::string nameComponent;
     std::cin >> nameComponent;
-    Name identityName(targetCaItem.m_caName);
+    Name identityName = targetCaItem.m_caName.getPrefix(-1);
     identityName.append(nameComponent);
     client.sendNew(targetCaItem, identityName,
                    bind(&ClientTool::newCb, &tool, _1, nStep),