diff --git a/netconf-service/netconf.cpp b/netconf-service/netconf.cpp
index 7a905863c..c016410bd 100644
--- a/netconf-service/netconf.cpp
+++ b/netconf-service/netconf.cpp
@@ -134,6 +134,19 @@ int main(int argc,char **argv)
 		return -1;
 	}
 
+	// Send ready message to tell parent that the service is up, and to
+	// solicit netconf-init.
+	{
+		Dictionary response;
+		response["type"] = "ready";
+		std::string respm = response.toString();
+		uint32_t respml = (uint32_t)htonl((uint32_t)respm.length());
+		stdoutWriteLock.lock();
+		write(STDOUT_FILENO,&respml,4);
+		write(STDOUT_FILENO,respm.data(),respm.length());
+		stdoutWriteLock.unlock();
+	}
+
 	for(;;) {
 		for(int l=0;l<4;) {
 			int n = (int)read(STDIN_FILENO,buf + l,4 - l);
@@ -200,13 +213,19 @@ int main(int argc,char **argv)
 			const std::string &reqType = request.get("type");
 			if (reqType == "netconf-init") { // initialization to set things like netconf's identity
 				Identity netconfId(request.get("netconfId"));
-				if ((netconfId)&&(netconfId.hasPrivate()))
+				if ((netconfId)&&(netconfId.hasPrivate())) {
 					signingIdentity = netconfId;
-				else {
+					fprintf(stderr,"got netconf signing identity: %s\n",signingIdentity.toString(false).c_str());
+				} else {
 					fprintf(stderr,"netconfId invalid or lacks private key\n");
 					return -1;
 				}
 			} else if (reqType == "netconf-request") { // NETWORK_CONFIG_REQUEST packet
+				if (!signingIdentity) {
+					fprintf(stderr,"no signing identity; missing netconf-init?\n");
+					return -1;
+				}
+
 				// Deserialize querying peer identity and network ID
 				Identity peerIdentity(request.get("peerId"));
 				uint64_t nwid = strtoull(request.get("nwid").c_str(),(char **)0,16);
@@ -459,7 +478,7 @@ int main(int argc,char **argv)
 					netconf[ZT_NETWORKCONFIG_DICT_KEY_IPV4_STATIC] = ipv4Static;
 				if (ipv6Static.length())
 					netconf[ZT_NETWORKCONFIG_DICT_KEY_IPV6_STATIC] = ipv6Static;
-				if ((!isOpen)&&(authenticated)&&(signingIdentity)&&(signingIdentity.hasPrivate())) {
+				if ((!isOpen)&&(authenticated)) {
 					CertificateOfMembership com(Utils::now(),ZT_NETWORK_AUTOCONF_DELAY * 3,nwid,peerIdentity.address());
 					com.sign(signingIdentity);
 					netconf[ZT_NETWORKCONFIG_DICT_KEY_CERTIFICATE_OF_MEMBERSHIP] = com.toString();
diff --git a/node/Node.cpp b/node/Node.cpp
index 815451fda..fe8cfb18f 100644
--- a/node/Node.cpp
+++ b/node/Node.cpp
@@ -235,7 +235,13 @@ static void _netconfServiceMessageHandler(void *renv,Service &svc,const Dictiona
 	try {
 		//TRACE("from netconf:\n%s",msg.toString().c_str());
 		const std::string &type = msg.get("type");
-		if (type == "netconf-response") {
+		if (type == "ready") {
+			LOG("received 'ready' from netconf.service, sending netconf-init with identity information...");
+			Dictionary initMessage;
+			initMessage["type"] = "netconf-init";
+			initMessage["netconfId"] = _r->identity.toString(true);
+			_r->netconfService->send(initMessage);
+		} else if (type == "netconf-response") {
 			uint64_t inRePacketId = strtoull(msg.get("requestId").c_str(),(char **)0,16);
 			uint64_t nwid = strtoull(msg.get("nwid").c_str(),(char **)0,16);
 			Address peerAddress(msg.get("peer").c_str());
@@ -442,7 +448,7 @@ Node::ReasonForTermination Node::run()
 	try {
 		std::string netconfServicePath(_r->homePath + ZT_PATH_SEPARATOR_S + "services.d" + ZT_PATH_SEPARATOR_S + "netconf.service");
 		if (Utils::fileExists(netconfServicePath.c_str())) {
-			LOG("netconf.d/netconfi.service appears to exist, starting...");
+			LOG("netconf.d/netconf.service appears to exist, starting...");
 			_r->netconfService = new Service(_r,"netconf",netconfServicePath.c_str(),&_netconfServiceMessageHandler,_r);
 			Dictionary initMessage;
 			initMessage["type"] = "netconf-init";