diff --git a/src/ca-module.cpp b/src/ca-module.cpp
index f982dc7..d8e44de 100644
--- a/src/ca-module.cpp
+++ b/src/ca-module.cpp
@@ -95,10 +95,6 @@
                                           bind(&CaModule::onChallenge, this, _2));
       m_interestFilterHandles.push_back(filterId);
 
-      // register DOWNLOAD prefix
-      filterId = m_face.setInterestFilter(Name(name).append("DOWNLOAD"),
-                                          bind(&CaModule::onDownload, this, _2));
-      m_interestFilterHandles.push_back(filterId);
       _LOG_TRACE("Prefix " << name << " got registered");
     },
     bind(&CaModule::onRegisterFailed, this, _2));
@@ -394,6 +390,7 @@
       }
       contentJson = genChallengeResponseJson(certRequest);
       contentJson.add(JSON_CA_CERT_ID, readString(issuedCert.getName().at(-1)));
+      contentJson.add(JSON_CHALLENGE_ISSUED_CERT_NAME, issuedCert.getName().toUri());
       _LOG_TRACE("Challenge succeeded. Certificate has been issued");
     }
     else {
@@ -428,26 +425,6 @@
   }
 }
 
-void
-CaModule::onDownload(const Interest& request)
-{
-  auto requestId = readString(request.getName().at(-1));
-  security::v2::Certificate signedCert;
-  try {
-    signedCert = m_storage->getCertificate(requestId);
-  }
-  catch (const std::exception& e) {
-    _LOG_ERROR("Cannot read signed cert " << requestId << " from CA's storage: " << e.what());
-    return;
-  }
-  Data result;
-  result.setName(request.getName());
-  result.setFreshnessPeriod(DEFAULT_DATA_FRESHNESS_PERIOD);
-  result.setContent(signedCert.wireEncode());
-  m_keyChain.sign(result, signingByIdentity(m_config.m_caName));
-  m_face.put(result);
-}
-
 security::v2::Certificate
 CaModule::issueCertificate(const CertificateRequest& certRequest)
 {
diff --git a/src/ca-module.hpp b/src/ca-module.hpp
index a873a27..80aaac0 100644
--- a/src/ca-module.hpp
+++ b/src/ca-module.hpp
@@ -84,9 +84,6 @@
   onChallenge(const Interest& request);
 
   void
-  onDownload(const Interest& request);
-
-  void
   onRegisterFailed(const std::string& reason);
 
   CertificateRequest
diff --git a/src/client-module.cpp b/src/client-module.cpp
index 8e3bd17..d3ace59 100644
--- a/src/client-module.cpp
+++ b/src/client-module.cpp
@@ -273,6 +273,7 @@
   m_challengeStatus = contentJson.get(JSON_CHALLENGE_STATUS, "");
   m_remainingTries = contentJson.get(JSON_CHALLENGE_REMAINING_TRIES, 0);
   m_freshBefore = time::system_clock::now() + time::seconds(contentJson.get(JSON_CHALLENGE_REMAINING_TIME, 0));
+  m_issuedCertName = contentJson.get(JSON_CHALLENGE_ISSUED_CERT_NAME, "");
 }
 
 shared_ptr<Interest>
@@ -289,23 +290,20 @@
 shared_ptr<Interest>
 ClientModule::generateCertFetchInterest()
 {
-  Name interestName = m_identityName;
-  interestName.append("KEY").append(m_certId);
+  Name interestName = m_issuedCertName;
   auto interest = make_shared<Interest>(interestName);
   interest->setMustBeFresh(true);
   interest->setCanBePrefix(false);
   return interest;
 }
 
-shared_ptr<security::v2::Certificate>
-ClientModule::onDownloadResponse(const Data& reply)
+void
+ClientModule::onCertFetchResponse(const Data& reply)
 {
   try {
     security::v2::Certificate cert(reply.getContent().blockFromValue());
     m_keyChain.addCertificate(m_key, cert);
-    _LOG_TRACE("Got DOWNLOAD response and installed the cert " << cert.getName());
-    m_isCertInstalled = true;
-    return make_shared<security::v2::Certificate>(cert);
+    _LOG_TRACE("Fetched and installed the cert " << cert.getName());
   }
   catch (const std::exception& e) {
     _LOG_ERROR("Cannot add replied certificate into the keychain " << e.what());
@@ -313,31 +311,6 @@
   }
 }
 
-void
-ClientModule::onCertFetchResponse(const Data& reply)
-{
-  onDownloadResponse(reply);
-}
-
-void
-ClientModule::endSession()
-{
-  if (getApplicationStatus() == STATUS_SUCCESS || getApplicationStatus() == STATUS_ENDED) {
-    return;
-  }
-  if (m_isNewlyCreatedIdentity) {
-    // put the identity into the if scope is because it may cause an error
-    // outside since when endSession is called, identity may not have been created yet.
-    auto identity = m_keyChain.getPib().getIdentity(m_identityName);
-    m_keyChain.deleteIdentity(identity);
-  }
-  else if (m_isNewlyCreatedKey) {
-    auto identity = m_keyChain.getPib().getIdentity(m_identityName);
-    m_keyChain.deleteKey(identity, m_key);
-  }
-  m_status = STATUS_ENDED;
-}
-
 JsonSection
 ClientModule::getJsonFromData(const Data& data)
 {
diff --git a/src/client-module.hpp b/src/client-module.hpp
index 7579ead..57ae01f 100644
--- a/src/client-module.hpp
+++ b/src/client-module.hpp
@@ -108,9 +108,6 @@
   shared_ptr<Interest>
   generateCertFetchInterest();
 
-  shared_ptr<security::v2::Certificate>
-  onDownloadResponse(const Data& reply);
-
   void
   onCertFetchResponse(const Data& reply);
 
@@ -148,6 +145,7 @@
   std::string m_challengeStatus = "";
   std::string m_challengeType = "";
   std::string m_certId = "";
+  std::string m_issuedCertName = "";
   std::list<std::string> m_challengeList;
   bool m_isCertInstalled = false;
   bool m_isNewlyCreatedIdentity = false;
diff --git a/src/ndncert-common.hpp b/src/ndncert-common.hpp
index 10020a0..d1fb8cf 100644
--- a/src/ndncert-common.hpp
+++ b/src/ndncert-common.hpp
@@ -102,6 +102,7 @@
 const std::string JSON_CHALLENGE_STATUS = "challenge-status";
 const std::string JSON_CHALLENGE_REMAINING_TRIES = "remaining-tries";
 const std::string JSON_CHALLENGE_REMAINING_TIME = "remaining-time";
+const std::string JSON_CHALLENGE_ISSUED_CERT_NAME = "issued-cert-name";
 
 // JSON format for Certificate Requester
 const std::string JSON_CLIENT_PROBE_INFO = "probe-info";
diff --git a/tests/unit-tests/ca-module.t.cpp b/tests/unit-tests/ca-module.t.cpp
index 6ea8947..81a5916 100644
--- a/tests/unit-tests/ca-module.t.cpp
+++ b/tests/unit-tests/ca-module.t.cpp
@@ -50,7 +50,7 @@
 
   advanceClocks(time::milliseconds(20), 60);
   BOOST_CHECK_EQUAL(ca.m_registeredPrefixHandles.size(), 2);
-  BOOST_CHECK_EQUAL(ca.m_interestFilterHandles.size(), 5); // onInfo, onProbe, onNew, onChallenge, onDownload
+  BOOST_CHECK_EQUAL(ca.m_interestFilterHandles.size(), 4); // onInfo, onProbe, onNew, onChallenge
 }
 
 BOOST_AUTO_TEST_CASE(HandleProbe)
diff --git a/tools/ndncert-client.cpp b/tools/ndncert-client.cpp
index 0154ea0..bc9182f 100644
--- a/tools/ndncert-client.cpp
+++ b/tools/ndncert-client.cpp
@@ -116,13 +116,9 @@
 }
 
 static void
-downloadCb(const Data& reply)
+certFetchCb(const Data& reply)
 {
-  auto cert = client.onDownloadResponse(reply);
-  if (cert == nullptr) {
-    std::cerr << "Certificate cannot be installed to your local keychain" << std::endl;
-    return;
-  }
+  client.onCertFetchResponse(reply);
   std::cerr << "Step " << nStep++
             << ": DONE! Certificate has already been installed to local keychain\n"
             << "Certificate Name: " << cert->getName().toUri() << std::endl;
@@ -134,7 +130,7 @@
   client.onChallengeResponse(reply);
   if (client.getApplicationStatus() == STATUS_SUCCESS) {
     std::cerr << "DONE! Certificate has already been issued \n";
-    face.expressInterest(*client.generateDownloadInterest(), bind(&downloadCb, _2),
+    face.expressInterest(*client.generateCertFetchInterest(), bind(&certFetchCb, _2),
                          bind(&onNackCb), bind(&timeoutCb));
     return;
   }