client certificate signing utility

2025-04-06 19:07:08 +00:00 · 2016-09-16 17:17:32 +01:00 · 2016-09-16 17:17:32 +01:00 · 9b4bf32fdc
commit 9b4bf32fdc
parent c328655f68
48 changed files with 1812 additions and 132 deletions
--- a/.idea/modules.xml
+++ b/.idea/modules.xml
@ -21,6 +21,9 @@
      <module fileurl="file://$PROJECT_DIR$/.idea/modules/contracts/isolated/isolated.iml" filepath="$PROJECT_DIR$/.idea/modules/contracts/isolated/isolated.iml" group="contracts/isolated" />
      <module fileurl="file://$PROJECT_DIR$/.idea/modules/contracts/isolated/isolated_main.iml" filepath="$PROJECT_DIR$/.idea/modules/contracts/isolated/isolated_main.iml" group="contracts/isolated" />
      <module fileurl="file://$PROJECT_DIR$/.idea/modules/contracts/isolated/isolated_test.iml" filepath="$PROJECT_DIR$/.idea/modules/contracts/isolated/isolated_test.iml" group="contracts/isolated" />
+      <module fileurl="file://$PROJECT_DIR$/.idea/modules/network-explorer/network-explorer_main.iml" filepath="$PROJECT_DIR$/.idea/modules/network-explorer/network-explorer_main.iml" group="network-explorer" />
+      <module fileurl="file://$PROJECT_DIR$/.idea/modules/network-explorer/network-explorer_test.iml" filepath="$PROJECT_DIR$/.idea/modules/network-explorer/network-explorer_test.iml" group="network-explorer" />
+      <module fileurl="file://$PROJECT_DIR$/.idea/modules/network-explorer/network-map-visualiser.iml" filepath="$PROJECT_DIR$/.idea/modules/network-explorer/network-map-visualiser.iml" group="network-explorer" />
      <module fileurl="file://$PROJECT_DIR$/.idea/modules/node/node.iml" filepath="$PROJECT_DIR$/.idea/modules/node/node.iml" group="node" />
      <module fileurl="file://$PROJECT_DIR$/.idea/modules/node/node_integrationTest.iml" filepath="$PROJECT_DIR$/.idea/modules/node/node_integrationTest.iml" group="node" />
      <module fileurl="file://$PROJECT_DIR$/.idea/modules/node/node_main.iml" filepath="$PROJECT_DIR$/.idea/modules/node/node_main.iml" group="node" />
@ -34,4 +37,4 @@
      <module fileurl="file://$PROJECT_DIR$/.idea/modules/test-utils/test-utils_test.iml" filepath="$PROJECT_DIR$/.idea/modules/test-utils/test-utils_test.iml" group="test-utils" />
    </modules>
  </component>
-</project>
+</project>
--- a/core/src/main/kotlin/com/r3corda/core/crypto/X509Utilities.kt
+++ b/core/src/main/kotlin/com/r3corda/core/crypto/X509Utilities.kt
@ -1,6 +1,7 @@
 package com.r3corda.core.crypto

 import com.r3corda.core.random63BitValue
+import com.r3corda.core.use
 import org.bouncycastle.asn1.ASN1Encodable
 import org.bouncycastle.asn1.ASN1EncodableVector
 import org.bouncycastle.asn1.DERSequence
@ -16,9 +17,14 @@ import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder
 import org.bouncycastle.jce.provider.BouncyCastleProvider
 import org.bouncycastle.openssl.jcajce.JcaPEMWriter
 import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder
+import org.bouncycastle.pkcs.PKCS10CertificationRequest
+import org.bouncycastle.pkcs.jcajce.JcaPKCS10CertificationRequestBuilder
 import org.bouncycastle.util.IPAddress
 import org.bouncycastle.util.io.pem.PemReader
-import java.io.*
+import java.io.ByteArrayInputStream
+import java.io.FileReader
+import java.io.FileWriter
+import java.io.InputStream
 import java.math.BigInteger
 import java.net.InetAddress
 import java.nio.file.Files
@ -41,10 +47,14 @@ object X509Utilities {
    val ECDSA_CURVE = "secp256r1"

    val KEYSTORE_TYPE = "JKS"
-    val CA_CERT_ALIAS = "CA Cert"
-    val CERT_PRIVATE_KEY_ALIAS = "Server Private Key"
-    val ROOT_CA_CERT_PRIVATE_KEY_ALIAS = "Root CA Private Key"
-    val INTERMEDIATE_CA_PRIVATE_KEY_ALIAS = "Intermediate CA Private Key"
+
+    // Aliases for private keys and certificates.
+    val CORDA_ROOT_CA_PRIVATE_KEY = "cordarootcaprivatekey"
+    val CORDA_ROOT_CA = "cordarootca"
+    val CORDA_INTERMEDIATE_CA_PRIVATE_KEY = "cordaintermediatecaprivatekey"
+    val CORDA_INTERMEDIATE_CA = "cordaintermediateca"
+    val CORDA_CLIENT_CA_PRIVATE_KEY = "cordaclientcaprivatekey"
+    val CORDA_CLIENT_CA = "cordaclientca"

    init {
        Security.addProvider(BouncyCastleProvider()) // register Bouncy Castle Crypto Provider required to sign certificates
@ -108,8 +118,15 @@ object X509Utilities {
        return nameBuilder.build()
    }

+    fun getX509Name(myLegalName: String, nearestCity: String, email: String): X500Name {
+        return X500NameBuilder(BCStyle.INSTANCE)
+                .addRDN(BCStyle.CN, myLegalName)
+                .addRDN(BCStyle.L, nearestCity)
+                .addRDN(BCStyle.E, email).build()
+    }
+
    /**
-     * Helper method to either open an existing keystore for modification, or create a new blank keystore
+     * Helper method to either open an existing keystore for modification, or create a new blank keystore.
     * @param keyStoreFilePath location of KeyStore file
     * @param storePassword password to open the store. This does not have to be the same password as any keys stored,
     * but for SSL purposes this is recommended.
@ -119,13 +136,10 @@ object X509Utilities {
        val pass = storePassword.toCharArray()
        val keyStore = KeyStore.getInstance(KEYSTORE_TYPE)
        if (Files.exists(keyStoreFilePath)) {
-            val input = FileInputStream(keyStoreFilePath.toFile())
-            input.use {
-                keyStore.load(input, pass)
-            }
+            keyStoreFilePath.use { keyStore.load(it, pass) }
        } else {
            keyStore.load(null, pass)
-            val output = FileOutputStream(keyStoreFilePath.toFile())
+            val output = Files.newOutputStream(keyStoreFilePath)
            output.use {
                keyStore.store(output, pass)
            }
@ -143,10 +157,7 @@ object X509Utilities {
    fun loadKeyStore(keyStoreFilePath: Path, storePassword: String): KeyStore {
        val pass = storePassword.toCharArray()
        val keyStore = KeyStore.getInstance(KEYSTORE_TYPE)
-        val input = FileInputStream(keyStoreFilePath.toFile())
-        input.use {
-            keyStore.load(input, pass)
-        }
+        keyStoreFilePath.use { keyStore.load(it, pass) }
        return keyStore
    }

@ -175,7 +186,7 @@ object X509Utilities {
     */
    fun saveKeyStore(keyStore: KeyStore, keyStoreFilePath: Path, storePassword: String) {
        val pass = storePassword.toCharArray()
-        val output = FileOutputStream(keyStoreFilePath.toFile())
+        val output = Files.newOutputStream(keyStoreFilePath)
        output.use {
            keyStore.store(output, pass)
        }
@ -189,7 +200,7 @@ object X509Utilities {
     * but for SSL purposes this is recommended.
     * @param chain the sequence of certificates starting with the public key certificate for this key and extending to the root CA cert
     */
-    private fun KeyStore.addOrReplaceKey(alias: String, key: Key, password: CharArray, chain: Array<Certificate>) {
+    fun KeyStore.addOrReplaceKey(alias: String, key: Key, password: CharArray, chain: Array<Certificate>) {
        try {
            this.deleteEntry(alias)
        } catch (kse: KeyStoreException) {
@ -203,7 +214,7 @@ object X509Utilities {
     * @param alias name to record the public certificate under
     * @param cert certificate to store
     */
-    private fun KeyStore.addOrReplaceCertificate(alias: String, cert: Certificate) {
+    fun KeyStore.addOrReplaceCertificate(alias: String, cert: Certificate) {
        try {
            this.deleteEntry(alias)
        } catch (kse: KeyStoreException) {
@ -224,6 +235,24 @@ object X509Utilities {
        return keyGen.generateKeyPair()
    }

+    /**
+     * Create certificate signing request using provided information.
+     *
+     * @param myLegalName The legal name of your organization. This should not be abbreviated and should include suffixes such as Inc, Corp, or LLC.
+     * @param nearestCity The city where your organization is located.
+     * @param email An email address used to contact your organization.
+     * @param keyPair Standard curve ECDSA KeyPair generated for TLS.
+     * @return The generated Certificate signing request.
+     */
+    fun createCertificateSigningRequest(myLegalName: String, nearestCity: String, email: String, keyPair: KeyPair): PKCS10CertificationRequest {
+        val subject = getX509Name(myLegalName, nearestCity, email)
+        val signer = JcaContentSignerBuilder(SIGNATURE_ALGORITHM)
+                .setProvider(BouncyCastleProvider.PROVIDER_NAME)
+                .build(keyPair.private)
+        return JcaPKCS10CertificationRequestBuilder(subject, keyPair.public).build(signer)
+    }
+
+
    /**
     * Helper data class to pass around public certificate and KeyPair entities when using CA certs
     */
@ -236,10 +265,10 @@ object X509Utilities {
     * @return A data class is returned containing the new root CA Cert and its KeyPair for signing downstream certificates.
     * Note the generated certificate tree is capped at max depth of 2 to be in line with commercially available certificates
     */
-    fun createSelfSignedCACert(domain: String): CACertAndKey {
+    fun createSelfSignedCACert(myLegalName: String): CACertAndKey {
        val keyPair = generateECDSAKeyPairForSSL()

-        val issuer = getDevX509Name(domain)
+        val issuer = getDevX509Name(myLegalName)
        val serial = BigInteger.valueOf(random63BitValue())
        val subject = issuer
        val pubKey = keyPair.public
@ -292,7 +321,7 @@ object X509Utilities {

        // Ten year certificate validity
        // TODO how do we manage certificate expiry, revocation and loss
-        val window = getCertificateValidityWindow(0, 365*10, certificateAuthority.certificate.notBefore, certificateAuthority.certificate.notAfter)
+        val window = getCertificateValidityWindow(0, 365 * 10, certificateAuthority.certificate.notBefore, certificateAuthority.certificate.notAfter)

        val builder = JcaX509v3CertificateBuilder(
                issuer, serial, window.first, window.second, subject, pubKey)
@ -341,7 +370,7 @@ object X509Utilities {

        // Ten year certificate validity
        // TODO how do we manage certificate expiry, revocation and loss
-        val window = getCertificateValidityWindow(0, 365*10, certificateAuthority.certificate.notBefore, certificateAuthority.certificate.notAfter)
+        val window = getCertificateValidityWindow(0, 365 * 10, certificateAuthority.certificate.notBefore, certificateAuthority.certificate.notAfter)

        val builder = JcaX509v3CertificateBuilder(issuer, serial, window.first, window.second, subject, publicKey)
        builder.addExtension(Extension.subjectKeyIdentifier, false, createSubjectKeyIdentifier(publicKey))
@ -420,7 +449,7 @@ object X509Utilities {
    }

    /**
-     * Extract public and private keys from a KeyStore file assuming storage alias is know
+     * Extract public and private keys from a KeyStore file assuming storage alias is known.
     * @param keyStoreFilePath Path to load KeyStore from
     * @param storePassword Password to unlock the KeyStore
     * @param keyPassword Password to unlock the private key entries
@ -437,6 +466,32 @@ object X509Utilities {
        return KeyPair(certificate.publicKey, keyEntry)
    }

+    /**
+     * Extract public and private keys from a KeyStore file assuming storage alias is known, or
+     * create a new pair of keys using the provided function if the keys not exist.
+     * @param keyStoreFilePath Path to load KeyStore from
+     * @param storePassword Password to unlock the KeyStore
+     * @param keyPassword Password to unlock the private key entries
+     * @param alias The name to lookup the Key and Certificate chain from
+     * @param keyGenerator Function for generating new keys
+     * @return The KeyPair found in the KeyStore under the specified alias
+     */
+    fun loadOrCreateKeyPairFromKeyStore(keyStoreFilePath: Path, storePassword: String, keyPassword: String,
+                                        alias: String, keyGenerator: () -> CACertAndKey): KeyPair {
+        val keyStore = X509Utilities.loadKeyStore(keyStoreFilePath, storePassword)
+        if (!keyStore.containsAlias(alias)) {
+            val selfSignCert = keyGenerator()
+            // Save to the key store.
+            keyStore.addOrReplaceKey(alias, selfSignCert.keypair.private, keyPassword.toCharArray(), arrayOf(selfSignCert.certificate))
+            X509Utilities.saveKeyStore(keyStore, keyStoreFilePath, storePassword)
+        }
+
+        val certificate = keyStore.getCertificate(alias)
+        val keyEntry = keyStore.getKey(alias, keyPassword.toCharArray())
+
+        return KeyPair(certificate.publicKey, keyEntry as PrivateKey)
+    }
+
    /**
     * Extract public X509 certificate from a KeyStore file assuming storage alias is know
     * @param keyStoreFilePath Path to load KeyStore from
@ -475,9 +530,9 @@ object X509Utilities {
        val keypass = keyPassword.toCharArray()
        val keyStore = loadOrCreateKeyStore(keyStoreFilePath, storePassword)

-        keyStore.addOrReplaceKey(ROOT_CA_CERT_PRIVATE_KEY_ALIAS, rootCA.keypair.private, keypass, arrayOf(rootCA.certificate))
+        keyStore.addOrReplaceKey(CORDA_ROOT_CA_PRIVATE_KEY, rootCA.keypair.private, keypass, arrayOf(rootCA.certificate))

-        keyStore.addOrReplaceKey(INTERMEDIATE_CA_PRIVATE_KEY_ALIAS,
+        keyStore.addOrReplaceKey(CORDA_INTERMEDIATE_CA_PRIVATE_KEY,
                intermediateCA.keypair.private,
                keypass,
                arrayOf(intermediateCA.certificate, rootCA.certificate))
@ -486,7 +541,8 @@ object X509Utilities {

        val trustStore = loadOrCreateKeyStore(trustStoreFilePath, trustStorePassword)

-        trustStore.addOrReplaceCertificate(CA_CERT_ALIAS, rootCA.certificate)
+        trustStore.addOrReplaceCertificate(CORDA_ROOT_CA, rootCA.certificate)
+        trustStore.addOrReplaceCertificate(CORDA_INTERMEDIATE_CA, intermediateCA.certificate)

        saveKeyStore(trustStore, trustStoreFilePath, trustStorePassword)

@ -527,10 +583,10 @@ object X509Utilities {
                             caKeyPassword: String): KeyStore {
        val rootCA = X509Utilities.loadCertificateAndKey(caKeyStore,
                caKeyPassword,
-                X509Utilities.ROOT_CA_CERT_PRIVATE_KEY_ALIAS)
+                X509Utilities.CORDA_ROOT_CA_PRIVATE_KEY)
        val intermediateCA = X509Utilities.loadCertificateAndKey(caKeyStore,
                caKeyPassword,
-                X509Utilities.INTERMEDIATE_CA_PRIVATE_KEY_ALIAS)
+                X509Utilities.CORDA_INTERMEDIATE_CA_PRIVATE_KEY)

        val serverKey = X509Utilities.generateECDSAKeyPairForSSL()
        val host = InetAddress.getLocalHost()
@ -538,18 +594,18 @@ object X509Utilities {
        val serverCert = X509Utilities.createServerCert(subject,
                serverKey.public,
                intermediateCA,
-                if(host.canonicalHostName == host.hostName) listOf() else listOf(host.hostName),
+                if (host.canonicalHostName == host.hostName) listOf() else listOf(host.hostName),
                listOf(host.hostAddress))

        val keypass = keyPassword.toCharArray()
        val keyStore = loadOrCreateKeyStore(keyStoreFilePath, storePassword)

-        keyStore.addOrReplaceKey(CERT_PRIVATE_KEY_ALIAS,
+        keyStore.addOrReplaceKey(CORDA_CLIENT_CA_PRIVATE_KEY,
                serverKey.private,
                keypass,
                arrayOf(serverCert, intermediateCA.certificate, rootCA.certificate))

-        keyStore.addOrReplaceCertificate(CA_CERT_ALIAS, rootCA.certificate)
+        keyStore.addOrReplaceCertificate(CORDA_CLIENT_CA, serverCert)

        saveKeyStore(keyStore, keyStoreFilePath, storePassword)

--- a/core/src/main/kotlin/com/r3corda/core/node/services/NetworkMapCache.kt
+++ b/core/src/main/kotlin/com/r3corda/core/node/services/NetworkMapCache.kt
@ -1,5 +1,6 @@
 package com.r3corda.core.node.services

+import com.google.common.annotations.VisibleForTesting
 import com.google.common.util.concurrent.ListenableFuture
 import com.r3corda.core.contracts.Contract
 import com.r3corda.core.crypto.Party
@ -32,6 +33,8 @@ interface NetworkMapCache {
    val partyNodes: List<NodeInfo>
    /** Tracks changes to the network map cache */
    val changed: Observable<MapChange>
+    /** Future to track completion of the NetworkMapService registration. */
+    val mapServiceRegistered: ListenableFuture<Unit>

    /**
     * A list of nodes that advertise a regulatory service. Identifying the correct regulator for a trade is outside
@ -97,6 +100,12 @@ interface NetworkMapCache {
     * @param service the network map service to fetch current state from.
     */
    fun deregisterForUpdates(net: MessagingService, service: NodeInfo): ListenableFuture<Unit>
+
+    /**
+     * For testing where the network map cache is manipulated marks the service as immediately ready.
+     */
+    @VisibleForTesting
+    fun runWithoutMapService()
 }

 sealed class NetworkCacheError : Exception() {
--- a/core/src/test/kotlin/com/r3corda/core/crypto/X509UtilitiesTest.kt
+++ b/core/src/test/kotlin/com/r3corda/core/crypto/X509UtilitiesTest.kt
@ -97,9 +97,9 @@ class X509UtilitiesTest {
        // Load back generated root CA Cert and private key from keystore and check against copy in truststore
        val keyStore = X509Utilities.loadKeyStore(tmpKeyStore, "keystorepass")
        val trustStore = X509Utilities.loadKeyStore(tmpTrustStore, "trustpass")
-        val rootCaCert = keyStore.getCertificate(X509Utilities.ROOT_CA_CERT_PRIVATE_KEY_ALIAS) as X509Certificate
-        val rootCaPrivateKey = keyStore.getKey(X509Utilities.ROOT_CA_CERT_PRIVATE_KEY_ALIAS, "keypass".toCharArray()) as PrivateKey
-        val rootCaFromTrustStore = trustStore.getCertificate(X509Utilities.CA_CERT_ALIAS) as X509Certificate
+        val rootCaCert = keyStore.getCertificate(X509Utilities.CORDA_ROOT_CA_PRIVATE_KEY) as X509Certificate
+        val rootCaPrivateKey = keyStore.getKey(X509Utilities.CORDA_ROOT_CA_PRIVATE_KEY, "keypass".toCharArray()) as PrivateKey
+        val rootCaFromTrustStore = trustStore.getCertificate(X509Utilities.CORDA_ROOT_CA) as X509Certificate
        assertEquals(rootCaCert, rootCaFromTrustStore)
        rootCaCert.checkValidity(Date())
        rootCaCert.verify(rootCaCert.publicKey)
@ -116,8 +116,8 @@ class X509UtilitiesTest {
        assertTrue { caVerifier.verify(caSignature) }

        // Load back generated intermediate CA Cert and private key
-        val intermediateCaCert = keyStore.getCertificate(X509Utilities.INTERMEDIATE_CA_PRIVATE_KEY_ALIAS) as X509Certificate
-        val intermediateCaCertPrivateKey = keyStore.getKey(X509Utilities.INTERMEDIATE_CA_PRIVATE_KEY_ALIAS, "keypass".toCharArray()) as PrivateKey
+        val intermediateCaCert = keyStore.getCertificate(X509Utilities.CORDA_INTERMEDIATE_CA_PRIVATE_KEY) as X509Certificate
+        val intermediateCaCertPrivateKey = keyStore.getKey(X509Utilities.CORDA_INTERMEDIATE_CA_PRIVATE_KEY, "keypass".toCharArray()) as PrivateKey
        intermediateCaCert.checkValidity(Date())
        intermediateCaCert.verify(rootCaCert.publicKey)

@ -148,14 +148,14 @@ class X509UtilitiesTest {

        // Load signing intermediate CA cert
        val caKeyStore = X509Utilities.loadKeyStore(tmpCAKeyStore, "cakeystorepass")
-        val caCertAndKey = X509Utilities.loadCertificateAndKey(caKeyStore, "cakeypass", X509Utilities.INTERMEDIATE_CA_PRIVATE_KEY_ALIAS)
+        val caCertAndKey = X509Utilities.loadCertificateAndKey(caKeyStore, "cakeypass", X509Utilities.CORDA_INTERMEDIATE_CA_PRIVATE_KEY)

        // Generate server cert and private key and populate another keystore suitable for SSL
        X509Utilities.createKeystoreForSSL(tmpServerKeyStore, "serverstorepass", "serverkeypass", caKeyStore, "cakeypass")

        // Load back server certificate
        val serverKeyStore = X509Utilities.loadKeyStore(tmpServerKeyStore, "serverstorepass")
-        val serverCertAndKey = X509Utilities.loadCertificateAndKey(serverKeyStore, "serverkeypass", X509Utilities.CERT_PRIVATE_KEY_ALIAS)
+        val serverCertAndKey = X509Utilities.loadCertificateAndKey(serverKeyStore, "serverkeypass", X509Utilities.CORDA_CLIENT_CA_PRIVATE_KEY)

        serverCertAndKey.certificate.checkValidity(Date())
        serverCertAndKey.certificate.verify(caCertAndKey.certificate.publicKey)
--- a/docs/source/index.rst
+++ b/docs/source/index.rst
@ -71,7 +71,7 @@ Read on to learn:

   release-process
   release-notes
-   visualiser
+   network-simulator
   codestyle
   building-the-docs

--- a/docs/source/network-simulator.png
+++ b/docs/source/network-simulator.png
--- a/docs/source/network-simulator.rst
+++ b/docs/source/network-simulator.rst
@ -0,0 +1,41 @@
+Network Simulator
+=================
+
+A network simulator is provided which shows traffic between nodes through the lifecycle of an interest rate swap
+contract. It can optionally also show network setup, during which nodes register themselves with the network
+map service and are notified of the changes to the map. The network simulator is run from the command line via Gradle:
+
+**Windows**::
+
+    gradlew.bat network-simulator:run
+
+**Other**::
+
+    ./gradlew network-simulator:run
+
+Interface
+---------
+
+.. image:: network-simulator.png
+
+The network simulator can be run automatically, or stepped manually through each step of the interest rate swap. The
+options on the simulator window are:
+
+Simulate initialisation
+  If checked, the nodes registering with the network map is shown. Normally this setup step
+  is not shown, but may be of interest to understand the details of node discovery.
+Run
+  Runs the network simulation in automatic mode, in which it progresses each step on a timed basis. Once running,
+  the simulation can be paused in order to manually progress it, or reset.
+Next
+  Manually progress the simulation to the next step.
+Reset
+  Reset the simulation (only available when paused).
+Map/Circle
+  How the nodes are shown, by default nodes are rendered on a world map, but alternatively they can rendered
+  in a circle layout.
+
+While the simulation runs, details of the steps currently being executed are shown in a sidebar on the left hand side
+of the window.
+
+.. TODO: Add documentation on how to use with different contracts for testing/debugging
--- a/docs/source/visualiser.png
+++ b/docs/source/visualiser.png
--- a/docs/source/visualiser.rst
+++ b/docs/source/visualiser.rst
@ -1,78 +0,0 @@
-.. highlight:: kotlin
-.. raw:: html
-
-   <script type="text/javascript" src="_static/jquery.js"></script>
-   <script type="text/javascript" src="_static/codesets.js"></script>
-
-Using the visualiser
-====================
-
-In order to assist with understanding of the state model, the repository includes a simple graph visualiser. The
-visualiser is integrated with the unit test framework and the same domain specific language. It is currently very
-early and the diagrams it produces are not especially beautiful. The intention is to improve it in future releases.
-
-.. image:: visualiser.png
-
-An example of how to use it can be seen in ``src/test/kotlin/contracts/CommercialPaperTests.kt``.
-
-Briefly, define a set of transactions in a group using the same DSL that is used in the unit tests. Here's an example
-of a trade lifecycle using the commercial paper contract
-
-.. container:: codeset
-
-   .. sourcecode:: kotlin
-
-      val group: TransactionGroupDSL<ContractState> = transactionGroupFor() {
-            roots {
-                transaction(900.DOLLARS.CASH `owned by` ALICE label "alice's $900")
-                transaction(someProfits.CASH `owned by` MEGA_CORP_PUBKEY label "some profits")
-            }
-
-            // Some CP is issued onto the ledger by MegaCorp.
-            transaction("Issuance") {
-                output("paper") { PAPER_1 }
-                arg(MEGA_CORP_PUBKEY) { CommercialPaper.Commands.Issue() }
-            }
-
-            // The CP is sold to alice for her $900, $100 less than the face value. At 10% interest after only 7 days,
-            // that sounds a bit too good to be true!
-            transaction("Trade") {
-                input("paper")
-                input("alice's $900")
-                output("borrowed $900") { 900.DOLLARS.CASH `owned by` MEGA_CORP_PUBKEY }
-                output("alice's paper") { "paper".output `owned by` ALICE }
-                arg(ALICE) { Cash.Commands.Move() }
-                arg(MEGA_CORP_PUBKEY) { CommercialPaper.Commands.Move() }
-            }
-
-            // Time passes, and Alice redeem's her CP for $1000, netting a $100 profit. MegaCorp has received $1200
-            // as a single payment from somewhere and uses it to pay Alice off, keeping the remaining $200 as change.
-            transaction("Redemption", redemptionTime) {
-                input("alice's paper")
-                input("some profits")
-
-                output("Alice's profit") { aliceGetsBack.CASH `owned by` ALICE }
-                output("Change") { (someProfits - aliceGetsBack).CASH `owned by` MEGA_CORP_PUBKEY }
-                if (!destroyPaperAtRedemption)
-                    output { "paper".output }
-
-                arg(MEGA_CORP_PUBKEY) { Cash.Commands.Move() }
-                arg(ALICE) { CommercialPaper.Commands.Redeem() }
-            }
-        }
-
-Now you can define a main method in your unit test class that takes the ``TransactionGroupDSL`` object and uses it:
-
-.. container:: codeset
-
-   .. sourcecode:: kotlin
-
-      CommercialPaperTests().trade().visualise()
-
-This will open up a window with the following features:
-
-* The nodes can be dragged around to try and obtain a better layout (an improved layout algorithm will be a future
-  feature).
-* States are rendered as circles. Transactions are small blue squares. Commands are small diamonds.
-* Clicking a state will open up a window that shows its fields.
-
--- a/network-simulator/build.gradle
+++ b/network-simulator/build.gradle
@ -0,0 +1,59 @@
+buildscript {
+    repositories {
+        mavenCentral()
+        maven {
+            url 'http://oss.sonatype.org/content/repositories/snapshots'
+        }
+    }
+    dependencies {
+        classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
+    }
+}
+
+apply plugin: 'java'
+apply plugin: 'kotlin'
+apply plugin: 'application'
+apply plugin: 'us.kirchmeier.capsule'
+
+group 'com.r3cev.prototyping'
+version '1.0-SNAPSHOT'
+
+sourceCompatibility = 1.5
+
+repositories {
+    mavenLocal()
+    mavenCentral()
+    jcenter()
+    maven {
+        url 'http://oss.sonatype.org/content/repositories/snapshots'
+    }
+    maven {
+        url 'https://dl.bintray.com/kotlin/exposed'
+    }
+}
+
+applicationDefaultJvmArgs = ["-javaagent:${rootProject.configurations.quasar.singleFile}"]
+mainClassName = 'com.r3cev.corda.netmap.NetworkMapVisualiserKt'
+
+dependencies {
+    compile project(":core")
+    compile project(":node")
+    compile project(":contracts")
+    compile rootProject
+
+    // GraphStream: For visualisation
+    compile "org.graphstream:gs-core:1.3"
+    compile "org.graphstream:gs-ui:1.3"
+
+    compile "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
+    testCompile group: 'junit', name: 'junit', version: '4.11'
+}
+
+task capsule(type: FatCapsule) {
+    applicationClass 'com.r3cev.corda.netmap.NetworkExplorerKt'
+    reallyExecutable
+    capsuleManifest {
+        minJavaVersion = '1.8.0'
+        javaAgents = [rootProject.configurations.quasar.singleFile.name]
+    }
+}
--- a/network-simulator/src/main/kotlin/com/r3cev/corda/netmap/NetworkMapVisualiser.kt
+++ b/network-simulator/src/main/kotlin/com/r3cev/corda/netmap/NetworkMapVisualiser.kt
@ -0,0 +1,358 @@
+/*
+ * Copyright 2015 Distributed Ledger Group LLC.  Distributed as Licensed Company IP to DLG Group Members
+ * pursuant to the August 7, 2015 Advisory Services Agreement and subject to the Company IP License terms
+ * set forth therein.
+ *
+ * All other rights reserved.
+ */
+
+package com.r3cev.corda.netmap
+
+import com.r3corda.core.messaging.SingleMessageRecipient
+import com.r3corda.core.then
+import com.r3corda.core.utilities.ProgressTracker
+import com.r3corda.testing.node.InMemoryMessagingNetwork
+import com.r3corda.testing.node.MockNetwork
+import com.r3corda.simulation.IRSSimulation
+import com.r3corda.simulation.Simulation
+import com.r3corda.node.services.network.NetworkMapService
+import javafx.animation.*
+import javafx.application.Application
+import javafx.application.Platform
+import javafx.beans.property.SimpleDoubleProperty
+import javafx.beans.value.WritableValue
+import javafx.geometry.Insets
+import javafx.geometry.Pos
+import javafx.scene.control.*
+import javafx.scene.input.KeyCode
+import javafx.scene.input.KeyCodeCombination
+import javafx.scene.layout.*
+import javafx.scene.paint.Color
+import javafx.scene.shape.Circle
+import javafx.scene.shape.Line
+import javafx.scene.shape.Polygon
+import javafx.stage.Stage
+import javafx.util.Duration
+import rx.Scheduler
+import rx.schedulers.Schedulers
+import java.nio.file.Files
+import java.nio.file.Paths
+import java.time.format.DateTimeFormatter
+import java.time.format.FormatStyle
+import java.util.*
+import kotlin.concurrent.schedule
+import kotlin.concurrent.scheduleAtFixedRate
+import kotlin.system.exitProcess
+import com.r3cev.corda.netmap.VisualiserViewModel.Style
+
+fun <T : Any> WritableValue<T>.keyValue(endValue: T, interpolator: Interpolator = Interpolator.EASE_OUT) = KeyValue(this, endValue, interpolator)
+
+// TODO: This code is all horribly ugly. Refactor to use TornadoFX to clean it up.
+
+class NetworkMapVisualiser : Application() {
+    enum class NodeType {
+        BANK, SERVICE
+    }
+
+    enum class RunPauseButtonLabel {
+        RUN, PAUSE;
+
+        override fun toString(): String {
+            return name.toLowerCase().capitalize()
+        }
+    }
+
+    sealed class RunningPausedState {
+        class Running(val tickTimer: TimerTask): RunningPausedState()
+        class Paused(): RunningPausedState()
+
+        val buttonLabel: RunPauseButtonLabel
+            get() {
+                return when (this) {
+                    is RunningPausedState.Running -> RunPauseButtonLabel.PAUSE
+                    is RunningPausedState.Paused -> RunPauseButtonLabel.RUN
+                }
+            }
+    }
+
+    private val view = VisualiserView()
+    private val viewModel = VisualiserViewModel()
+
+    val timer = Timer()
+    val uiThread: Scheduler = Schedulers.from { Platform.runLater(it) }
+
+    override fun start(stage: Stage) {
+        viewModel.view = view
+        viewModel.presentationMode = "--presentation-mode" in parameters.raw
+        buildScene(stage)
+        viewModel.displayStyle = if ("--circle" in parameters.raw) { Style.CIRCLE } else { viewModel.displayStyle }
+
+        val simulation = viewModel.simulation
+        // Update the white-backgrounded label indicating what protocol step it's up to.
+        simulation.allProtocolSteps.observeOn(uiThread).subscribe { step: Pair<Simulation.SimulatedNode, ProgressTracker.Change> ->
+            val (node, change) = step
+            val label = viewModel.nodesToWidgets[node]!!.statusLabel
+            if (change is ProgressTracker.Change.Position) {
+                // Fade in the status label if it's our first step.
+                if (label.text == "") {
+                    with(FadeTransition(Duration(150.0), label)) {
+                        fromValue = 0.0
+                        toValue = 1.0
+                        play()
+                    }
+                }
+                label.text = change.newStep.label
+                if (change.newStep == ProgressTracker.DONE && change.tracker == change.tracker.topLevelTracker) {
+                    runLater(500, -1) {
+                        // Fade out the status label.
+                        with(FadeTransition(Duration(750.0), label)) {
+                            fromValue = 1.0
+                            toValue = 0.0
+                            setOnFinished { label.text = "" }
+                            play()
+                        }
+                    }
+                }
+            } else if (change is ProgressTracker.Change.Rendering) {
+                label.text = change.ofStep.label
+            }
+        }
+        // Fire the message bullets between nodes.
+        simulation.network.messagingNetwork.sentMessages.observeOn(uiThread).subscribe { msg: InMemoryMessagingNetwork.MessageTransfer ->
+            val senderNode: MockNetwork.MockNode = simulation.network.addressToNode(msg.sender.myAddress)
+            val destNode: MockNetwork.MockNode = simulation.network.addressToNode(msg.recipients as SingleMessageRecipient)
+
+            if (transferIsInteresting(msg)) {
+                viewModel.nodesToWidgets[senderNode]!!.pulseAnim.play()
+                viewModel.fireBulletBetweenNodes(senderNode, destNode, "bank", "bank")
+            }
+        }
+        // Pulse all parties in a trade when the trade completes
+        simulation.doneSteps.observeOn(uiThread).subscribe { nodes: Collection<Simulation.SimulatedNode> ->
+            nodes.forEach { viewModel.nodesToWidgets[it]!!.longPulseAnim.play() }
+        }
+
+        stage.setOnCloseRequest { exitProcess(0) }
+        //stage.isMaximized = true
+        stage.show()
+    }
+
+    fun runLater(startAfter: Int, delayBetween: Int, body: () -> Unit) {
+        if (delayBetween != -1) {
+            timer.scheduleAtFixedRate(startAfter.toLong(), delayBetween.toLong()) {
+                Platform.runLater {
+                    body()
+                }
+            }
+        } else {
+            timer.schedule(startAfter.toLong()) {
+                Platform.runLater {
+                    body()
+                }
+            }
+        }
+    }
+
+    private fun buildScene(stage: Stage) {
+        view.stage = stage
+        view.setup(viewModel.runningPausedState, viewModel.displayStyle, viewModel.presentationMode)
+        bindSidebar()
+        bindTopbar()
+        viewModel.createNodes()
+
+        // Spacebar advances simulation by one step.
+        stage.scene.accelerators[KeyCodeCombination(KeyCode.SPACE)] = Runnable { onNextInvoked() }
+
+        reloadStylesheet(stage)
+
+        stage.focusedProperty().addListener { value, old, new ->
+            if (new) {
+                reloadStylesheet(stage)
+            }
+        }
+    }
+
+    private fun bindTopbar() {
+        view.resetButton.setOnAction({reset()})
+        view.nextButton.setOnAction {
+            if (!view.simulateInitialisationCheckbox.isSelected && !viewModel.simulation.networkInitialisationFinished.isDone) {
+                skipNetworkInitialisation()
+            } else {
+                onNextInvoked()
+            }
+        }
+        viewModel.simulation.networkInitialisationFinished.then {
+            view.simulateInitialisationCheckbox.isVisible = false
+        }
+        view.runPauseButton.setOnAction {
+            val oldRunningPausedState = viewModel.runningPausedState
+            val newRunningPausedState = when (oldRunningPausedState) {
+                is NetworkMapVisualiser.RunningPausedState.Running -> {
+                    oldRunningPausedState.tickTimer.cancel()
+
+                    view.nextButton.isDisable = false
+                    view.resetButton.isDisable = false
+
+                    NetworkMapVisualiser.RunningPausedState.Paused()
+                }
+                is NetworkMapVisualiser.RunningPausedState.Paused -> {
+                    val tickTimer = timer.scheduleAtFixedRate(viewModel.stepDuration.toMillis().toLong(), viewModel.stepDuration.toMillis().toLong()) {
+                        Platform.runLater {
+                            onNextInvoked()
+                        }
+                    }
+
+                    view.nextButton.isDisable = true
+                    view.resetButton.isDisable = true
+
+                    if (!view.simulateInitialisationCheckbox.isSelected && !viewModel.simulation.networkInitialisationFinished.isDone) {
+                        skipNetworkInitialisation()
+                    }
+
+                    NetworkMapVisualiser.RunningPausedState.Running(tickTimer)
+                }
+            }
+
+            view.runPauseButton.text = newRunningPausedState.buttonLabel.toString()
+            viewModel.runningPausedState = newRunningPausedState
+        }
+        view.styleChoice.selectionModel.selectedItemProperty()
+                .addListener { ov, value, newValue -> viewModel.displayStyle = newValue }
+        viewModel.simulation.dateChanges.observeOn(uiThread).subscribe { view.dateLabel.text = it.format(DateTimeFormatter.ofLocalizedDate(FormatStyle.MEDIUM)) }
+    }
+
+    private fun reloadStylesheet(stage: Stage) {
+        stage.scene.stylesheets.clear()
+        stage.scene.stylesheets.add(NetworkMapVisualiser::class.java.getResource("styles.css").toString())
+    }
+
+    private fun bindSidebar() {
+        viewModel.simulation.allProtocolSteps.observeOn(uiThread).subscribe { step: Pair<Simulation.SimulatedNode, ProgressTracker.Change> ->
+            val (node, change) = step
+
+            if (change is ProgressTracker.Change.Position) {
+                val tracker = change.tracker.topLevelTracker
+                if (change.newStep == ProgressTracker.DONE) {
+                    if (change.tracker == tracker) {
+                        // Protocol done; schedule it for removal in a few seconds. We batch them up to make nicer
+                        // animations.
+                        println("Protocol done for ${node.info.identity.name}")
+                        viewModel.doneTrackers += tracker
+                    } else {
+                        // Subprotocol is done; ignore it.
+                    }
+                } else if (!viewModel.trackerBoxes.containsKey(tracker)) {
+                    // New protocol started up; add.
+                    val extraLabel = viewModel.simulation.extraNodeLabels[node]
+                    val label = if (extraLabel != null) "${node.storage.myLegalIdentity.name}: $extraLabel" else node.storage.myLegalIdentity.name
+                    val widget = view.buildProgressTrackerWidget(label, tracker.topLevelTracker)
+                    bindProgressTracketWidget(tracker.topLevelTracker, widget)
+                    println("Added: ${tracker}, ${widget}")
+                    viewModel.trackerBoxes[tracker] = widget.vbox
+                    view.sidebar.children += widget.vbox
+                }
+            }
+        }
+
+        Timer().scheduleAtFixedRate(0, 500) {
+            Platform.runLater {
+                for (tracker in viewModel.doneTrackers) {
+                    val pane = viewModel.trackerBoxes[tracker]!!
+                    // Slide the other tracker widgets up and over this one.
+                    val slideProp = SimpleDoubleProperty(0.0)
+                    slideProp.addListener { obv -> pane.padding = Insets(0.0, 0.0, slideProp.value, 0.0) }
+                    val timeline = Timeline(
+                            KeyFrame(Duration(250.0),
+                                    KeyValue(pane.opacityProperty(), 0.0),
+                                    KeyValue(slideProp, -pane.height - 50.0)  // Subtract the bottom padding gap.
+                            )
+                    )
+                    timeline.setOnFinished {
+                        println("Removed: ${tracker}")
+                        val vbox = viewModel.trackerBoxes.remove(tracker)
+                        view.sidebar.children.remove(vbox)
+                    }
+                    timeline.play()
+                }
+                viewModel.doneTrackers.clear()
+            }
+        }
+    }
+
+    private fun bindProgressTracketWidget(tracker: ProgressTracker, widget: TrackerWidget) {
+        val allSteps: List<Pair<Int, ProgressTracker.Step>> = tracker.allSteps
+        tracker.changes.observeOn(uiThread).subscribe { step: ProgressTracker.Change ->
+            val stepHeight = widget.cursorBox.height / allSteps.size
+            if (step is ProgressTracker.Change.Position) {
+                // Figure out the index of the new step.
+                val curStep = allSteps.indexOfFirst { it.second == step.newStep }
+                // Animate the cursor to the right place.
+                with(TranslateTransition(Duration(350.0), widget.cursor)) {
+                    fromY = widget.cursor.translateY
+                    toY = (curStep * stepHeight) + 22.5
+                    play()
+                }
+            } else if (step is ProgressTracker.Change.Structural) {
+                val new = view.buildProgressTrackerWidget(widget.label.text, tracker)
+                val prevWidget = viewModel.trackerBoxes[step.tracker] ?: throw AssertionError("No previous widget for tracker: ${step.tracker}")
+                val i = (prevWidget.parent as VBox).children.indexOf(viewModel.trackerBoxes[step.tracker])
+                (prevWidget.parent as VBox).children[i] = new.vbox
+                viewModel.trackerBoxes[step.tracker] = new.vbox
+            }
+        }
+    }
+
+    var started = false
+    private fun startSimulation() {
+        if (!started) {
+            viewModel.simulation.start()
+            started = true
+        }
+    }
+
+    private fun reset() {
+        viewModel.simulation.stop()
+        viewModel.simulation = IRSSimulation(true, false, null)
+        started = false
+        start(view.stage)
+    }
+
+    private fun skipNetworkInitialisation() {
+        startSimulation()
+        while (!viewModel.simulation.networkInitialisationFinished.isDone) {
+            iterateSimulation()
+        }
+    }
+
+    private fun onNextInvoked() {
+        if (started) {
+            iterateSimulation()
+        } else {
+            startSimulation()
+        }
+    }
+
+    private fun iterateSimulation() {
+        // Loop until either we ran out of things to do, or we sent an interesting message.
+        while (true) {
+            val transfer: InMemoryMessagingNetwork.MessageTransfer = viewModel.simulation.iterate() ?: break
+            if (transferIsInteresting(transfer))
+                break
+            else
+                System.err.println("skipping boring $transfer")
+        }
+    }
+
+    private fun transferIsInteresting(transfer: InMemoryMessagingNetwork.MessageTransfer): Boolean {
+        // Loopback messages are boring.
+        if (transfer.sender.myAddress == transfer.recipients) return false
+        // Network map push acknowledgements are boring.
+        if (NetworkMapService.PUSH_ACK_PROTOCOL_TOPIC in transfer.message.topicSession.topic) return false
+
+        return true
+    }
+}
+
+fun main(args: Array<String>) {
+    Application.launch(NetworkMapVisualiser::class.java, *args)
+}
--- a/network-simulator/src/main/kotlin/com/r3cev/corda/netmap/VisualiserUtils.kt
+++ b/network-simulator/src/main/kotlin/com/r3cev/corda/netmap/VisualiserUtils.kt
@ -0,0 +1,18 @@
+package com.r3cev.corda.netmap
+
+import javafx.scene.paint.Color
+
+internal
+fun colorToRgb(color: Color): String {
+    val builder = StringBuilder()
+
+    builder.append("rgb(")
+    builder.append(Math.round(color.red * 256))
+    builder.append(",")
+    builder.append(Math.round(color.green * 256))
+    builder.append(",")
+    builder.append(Math.round(color.blue * 256))
+    builder.append(")")
+
+    return builder.toString()
+}
--- a/network-simulator/src/main/kotlin/com/r3cev/corda/netmap/VisualiserView.kt
+++ b/network-simulator/src/main/kotlin/com/r3cev/corda/netmap/VisualiserView.kt
@ -0,0 +1,304 @@
+package com.r3cev.corda.netmap
+
+import com.r3corda.core.utilities.ProgressTracker
+import javafx.animation.KeyFrame
+import javafx.animation.Timeline
+import javafx.application.Platform
+import javafx.collections.FXCollections
+import javafx.event.EventHandler
+import javafx.geometry.Insets
+import javafx.geometry.Pos
+import javafx.scene.Group
+import javafx.scene.Node
+import javafx.scene.Scene
+import javafx.scene.control.*
+import javafx.scene.image.Image
+import javafx.scene.image.ImageView
+import javafx.scene.input.ZoomEvent
+import javafx.scene.layout.*
+import javafx.scene.paint.Color
+import javafx.scene.shape.Polygon
+import javafx.scene.text.Font
+import javafx.stage.Stage
+import javafx.util.Duration
+import com.r3cev.corda.netmap.VisualiserViewModel.Style
+
+data class TrackerWidget(val vbox: VBox, val cursorBox: Pane, val label: Label, val cursor: Polygon)
+
+internal class VisualiserView() {
+    lateinit var root: Pane
+    lateinit var stage: Stage
+    lateinit var splitter: SplitPane
+    lateinit var sidebar: VBox
+    lateinit var resetButton: Button
+    lateinit var nextButton: Button
+    lateinit var runPauseButton: Button
+    lateinit var simulateInitialisationCheckbox: CheckBox
+    lateinit var styleChoice: ChoiceBox<Style>
+
+    var dateLabel = Label("")
+    var scrollPane: ScrollPane? = null
+    var hideButton = Button("«").apply { styleClass += "hide-sidebar-button" }
+
+
+    // -23.2031,29.8406,33.0469,64.3209
+    val mapImage = ImageView(Image(NetworkMapVisualiser::class.java.getResourceAsStream("Europe.jpg")))
+
+    val backgroundColor: Color = mapImage.image.pixelReader.getColor(0, 0)
+
+    val stageWidth = 1024.0
+    val stageHeight = 768.0
+    var defaultZoom = 0.7
+
+    val bitmapWidth = 1900.0
+    val bitmapHeight = 1900.0
+
+    fun setup(runningPausedState: NetworkMapVisualiser.RunningPausedState,
+              displayStyle: Style,
+              presentationMode: Boolean) {
+        NetworkMapVisualiser::class.java.getResourceAsStream("SourceSansPro-Regular.otf").use {
+            Font.loadFont(it, 120.0)
+        }
+        if(displayStyle == Style.MAP) {
+            mapImage.onZoom = EventHandler<javafx.scene.input.ZoomEvent> { event ->
+                event.consume()
+                mapImage.fitWidth = mapImage.fitWidth * event.zoomFactor
+                mapImage.fitHeight = mapImage.fitHeight * event.zoomFactor
+                //repositionNodes()
+            }
+        }
+        scaleMap(displayStyle);
+        root = Pane(mapImage)
+        root.background = Background(BackgroundFill(backgroundColor, CornerRadii.EMPTY, Insets.EMPTY))
+        scrollPane = buildScrollPane(backgroundColor, displayStyle)
+
+        val vbox = makeTopBar(runningPausedState, displayStyle, presentationMode)
+        StackPane.setAlignment(vbox, Pos.TOP_CENTER)
+
+        // Now build the sidebar
+        val defaultSplitterPosition = 0.3
+        splitter = SplitPane(makeSidebar(), scrollPane)
+        splitter.styleClass += "splitter"
+        Platform.runLater {
+            splitter.dividers[0].position = defaultSplitterPosition
+        }
+        VBox.setVgrow(splitter, Priority.ALWAYS)
+
+        // And the left hide button.
+        hideButton = makeHideButton(defaultSplitterPosition)
+
+        val screenStack = VBox(vbox, StackPane(splitter, hideButton))
+        screenStack.styleClass += "root-pane"
+        stage.scene = Scene(screenStack, backgroundColor)
+        stage.width = 1024.0
+        stage.height = 768.0
+    }
+
+    fun buildScrollPane(backgroundColor: Color, displayStyle: Style): ScrollPane {
+        when (displayStyle) {
+            Style.MAP -> {
+                mapImage.fitWidth = bitmapWidth * defaultZoom
+                mapImage.fitHeight = bitmapHeight * defaultZoom
+                mapImage.onZoom = EventHandler<ZoomEvent> { event ->
+                    event.consume()
+                    mapImage.fitWidth = mapImage.fitWidth * event.zoomFactor
+                    mapImage.fitHeight = mapImage.fitHeight * event.zoomFactor
+                }
+            }
+            Style.CIRCLE -> {
+                val scaleRatio = Math.min(stageWidth / bitmapWidth, stageHeight / bitmapHeight)
+                mapImage.fitWidth = bitmapWidth * scaleRatio
+                mapImage.fitHeight = bitmapHeight * scaleRatio
+            }
+        }
+
+        return ScrollPane(Group(root)).apply {
+            when (displayStyle) {
+                Style.MAP -> {
+                    hvalue = 0.4
+                    vvalue = 0.7
+                }
+                Style.CIRCLE -> {
+                    hvalue = 0.0
+                    vvalue = 0.0
+                }
+            }
+            hbarPolicy = ScrollPane.ScrollBarPolicy.NEVER
+            vbarPolicy = ScrollPane.ScrollBarPolicy.NEVER
+            isPannable = true
+            isFocusTraversable = false
+            style = "-fx-background-color: " + colorToRgb(backgroundColor)
+            styleClass += "edge-to-edge"
+        }
+    }
+
+
+    fun makeHideButton(defaultSplitterPosition: Double): Button {
+        var hideButtonToggled = false
+        hideButton.isFocusTraversable = false
+        hideButton.setOnAction {
+            if (!hideButtonToggled) {
+                hideButton.translateXProperty().unbind()
+                Timeline(
+                        KeyFrame(Duration.millis(500.0),
+                                splitter.dividers[0].positionProperty().keyValue(0.0),
+                                hideButton.translateXProperty().keyValue(0.0),
+                                hideButton.rotateProperty().keyValue(180.0)
+                        )
+                ).play()
+            } else {
+                bindHideButtonPosition()
+                Timeline(
+                        KeyFrame(Duration.millis(500.0),
+                                splitter.dividers[0].positionProperty().keyValue(defaultSplitterPosition),
+                                hideButton.rotateProperty().keyValue(0.0)
+                        )
+                ).play()
+            }
+            hideButtonToggled = !hideButtonToggled
+        }
+        bindHideButtonPosition()
+        StackPane.setAlignment(hideButton, Pos.TOP_LEFT)
+        return hideButton
+    }
+
+    fun bindHideButtonPosition() {
+        hideButton.translateXProperty().unbind()
+        hideButton.translateXProperty().bind(splitter.dividers[0].positionProperty().multiply(splitter.widthProperty()).subtract(hideButton.widthProperty()))
+    }
+    
+    fun scaleMap(displayStyle: Style) {
+        when (displayStyle) {
+            Style.MAP -> {
+                mapImage.fitWidth = bitmapWidth * defaultZoom
+                mapImage.fitHeight = bitmapHeight * defaultZoom
+            }
+            Style.CIRCLE -> {
+                val scaleRatio = Math.min(stageWidth / bitmapWidth, stageHeight / bitmapHeight)
+                mapImage.fitWidth = bitmapWidth * scaleRatio
+                mapImage.fitHeight = bitmapHeight * scaleRatio
+            }
+        }
+    }
+
+    fun makeSidebar(): Node {
+        sidebar = VBox()
+        sidebar.styleClass += "sidebar"
+        sidebar.isFillWidth = true
+        val sp = ScrollPane(sidebar)
+        sp.isFitToWidth = true
+        sp.isFitToHeight = true
+        sp.styleClass += "sidebar"
+        sp.hbarPolicy = ScrollPane.ScrollBarPolicy.NEVER
+        sp.vbarPolicy = ScrollPane.ScrollBarPolicy.NEVER
+        sp.minWidth = 0.0
+        return sp
+    }
+
+    fun makeTopBar(runningPausedState: NetworkMapVisualiser.RunningPausedState,
+                   displayStyle: Style,
+                   presentationMode: Boolean): VBox {
+        nextButton = Button("Next").apply {
+            styleClass += "button"
+            styleClass += "next-button"
+        }
+        runPauseButton = Button(runningPausedState.buttonLabel.toString()).apply {
+            styleClass += "button"
+            styleClass += "run-button"
+        }
+        simulateInitialisationCheckbox = CheckBox("Simulate initialisation")
+        resetButton = Button("Reset").apply {
+            styleClass += "button"
+            styleClass += "reset-button"
+        }
+
+        val displayStyles = FXCollections.observableArrayList<Style>()
+        Style.values().forEach { displayStyles.add(it) }
+
+        styleChoice = ChoiceBox(displayStyles).apply {
+            styleClass += "choice"
+            styleClass += "style-choice"
+        }
+        styleChoice.value = displayStyle
+
+        val dropShadow = Pane().apply { styleClass += "drop-shadow-pane-horizontal"; minHeight = 8.0 }
+        val logoImage = ImageView(javaClass.getResource("R3 logo.png").toExternalForm())
+        logoImage.fitHeight = 65.0
+        logoImage.isPreserveRatio = true
+        val logoLabel = HBox(logoImage, VBox(
+                Label("D I S T R I B U T E D   L E D G E R   G R O U P").apply { styleClass += "dlg-label" },
+                Label("Network Simulator").apply { styleClass += "logo-label" }
+        ))
+        logoLabel.spacing = 10.0
+        HBox.setHgrow(logoLabel, Priority.ALWAYS)
+        logoLabel.setPrefSize(Region.USE_COMPUTED_SIZE, Region.USE_PREF_SIZE)
+        dateLabel = Label("").apply { styleClass += "date-label" }
+
+        // Buttons area. In presentation mode there are no controls visible and you must use the keyboard.
+        val hbox = if (presentationMode) {
+            HBox(logoLabel, dateLabel).apply { styleClass += "controls-hbox" }
+        } else {
+            HBox(logoLabel, dateLabel, simulateInitialisationCheckbox, runPauseButton, nextButton, resetButton, styleChoice).apply { styleClass += "controls-hbox" }
+        }
+        hbox.styleClass += "fat-buttons"
+        hbox.spacing = 20.0
+        hbox.alignment = Pos.CENTER_RIGHT
+        hbox.padding = Insets(10.0, 20.0, 10.0, 20.0)
+        val vbox = VBox(hbox, dropShadow)
+        vbox.styleClass += "controls-vbox"
+        vbox.setPrefSize(Region.USE_COMPUTED_SIZE, Region.USE_COMPUTED_SIZE)
+        vbox.setMaxSize(Region.USE_COMPUTED_SIZE, Region.USE_PREF_SIZE)
+        return vbox
+    }
+
+    // TODO: Extract this to a real widget.
+    fun buildProgressTrackerWidget(label: String, tracker: ProgressTracker): TrackerWidget {
+        val allSteps: List<Pair<Int, ProgressTracker.Step>> = tracker.allSteps
+        val stepsBox = VBox().apply {
+            styleClass += "progress-tracker-widget-steps"
+        }
+        for ((indent, step) in allSteps) {
+            val stepLabel = Label(step.label).apply { padding = Insets(0.0, 0.0, 0.0, indent * 15.0) }
+            stepsBox.children += StackPane(stepLabel)
+        }
+        val arrowSize = 7.0
+        val cursor = Polygon(-arrowSize, -arrowSize, arrowSize, 0.0, -arrowSize, arrowSize).apply {
+            styleClass += "progress-tracker-cursor"
+        }
+        val cursorBox = Pane(cursor).apply {
+            styleClass += "progress-tracker-cursor-box"
+            minWidth = 25.0
+        }
+        val curStep = allSteps.indexOfFirst { it.second == tracker.currentStep }
+        Platform.runLater {
+            val stepHeight = cursorBox.height / allSteps.size
+            cursor.translateY = (curStep * stepHeight) + 20.0
+        }
+        val vbox: VBox?
+        HBox.setHgrow(stepsBox, Priority.ALWAYS)
+        val content = HBox(cursorBox, stepsBox)
+        // Make the title bar
+        val title = Label(label).apply { styleClass += "sidebar-title-label" }
+        StackPane.setAlignment(title, Pos.CENTER_LEFT)
+        vbox = VBox(StackPane(title), content)
+        vbox.padding = Insets(0.0, 0.0, 25.0, 0.0)
+        return TrackerWidget(vbox, cursorBox, title, cursor)
+    }
+
+    /**
+     * Update the current display style. MUST only be called on the UI
+     * thread.
+     */
+    fun updateDisplayStyle(displayStyle: Style) {
+        requireNotNull(splitter)
+        splitter.items.remove(scrollPane!!)
+        scrollPane = buildScrollPane(backgroundColor, displayStyle)
+        splitter.items.add(scrollPane!!)
+        splitter.dividers[0].position = 0.3
+        mapImage.isVisible = when (displayStyle) {
+            Style.MAP -> true
+            Style.CIRCLE -> false
+        }
+        // TODO: Can any current bullets be re-routed in flight?
+    }
+}
--- a/network-simulator/src/main/kotlin/com/r3cev/corda/netmap/VisualiserViewModel.kt
+++ b/network-simulator/src/main/kotlin/com/r3cev/corda/netmap/VisualiserViewModel.kt
@ -0,0 +1,222 @@
+package com.r3cev.corda.netmap
+
+import com.r3corda.core.utilities.ProgressTracker
+import com.r3corda.testing.node.MockNetwork
+import com.r3corda.simulation.IRSSimulation
+import javafx.animation.*
+import javafx.geometry.Pos
+import javafx.scene.control.Label
+import javafx.scene.layout.Pane
+import javafx.scene.layout.StackPane
+import javafx.scene.shape.Circle
+import javafx.scene.shape.Line
+import javafx.util.Duration
+import java.util.*
+
+class VisualiserViewModel {
+    enum class Style {
+        MAP, CIRCLE;
+
+        override fun toString(): String {
+            return name.toLowerCase().capitalize()
+        }
+    }
+    
+    inner class NodeWidget(val node: MockNetwork.MockNode, val innerDot: Circle, val outerDot: Circle, val longPulseDot: Circle,
+                           val pulseAnim: Animation, val longPulseAnim: Animation,
+                           val nameLabel: Label, val statusLabel: Label) {
+        fun position(index: Int, nodeCoords: (node: MockNetwork.MockNode, index: Int) -> Pair<Double, Double>) {
+            val (x, y) = nodeCoords(node, index)
+            innerDot.centerX = x
+            innerDot.centerY = y
+            outerDot.centerX = x
+            outerDot.centerY = y
+            longPulseDot.centerX = x
+            longPulseDot.centerY = y
+            (nameLabel.parent as StackPane).relocate(x - 270.0, y - 10.0)
+            (statusLabel.parent as StackPane).relocate(x + 20.0, y - 10.0)
+        }
+    }
+
+    internal lateinit var view: VisualiserView
+    var presentationMode: Boolean = false
+    var simulation = IRSSimulation(true, false, null)   // Manually pumped.
+
+    val trackerBoxes = HashMap<ProgressTracker, Pane>()
+    val doneTrackers = ArrayList<ProgressTracker>()
+    val nodesToWidgets = HashMap<MockNetwork.MockNode, NodeWidget>()
+
+    var bankCount: Int = 0
+    var serviceCount: Int = 0
+
+    var stepDuration = Duration.millis(500.0)
+    var runningPausedState: NetworkMapVisualiser.RunningPausedState = NetworkMapVisualiser.RunningPausedState.Paused()
+
+    var displayStyle: Style = Style.MAP
+        set(value) {
+            field = value
+            view.updateDisplayStyle(value)
+            repositionNodes()
+            view.bindHideButtonPosition()
+        }
+
+    fun repositionNodes() {
+        for ((index, bank) in simulation.banks.withIndex()) {
+            nodesToWidgets[bank]!!.position(index, when (displayStyle) {
+                Style.MAP -> { node, index -> nodeMapCoords(node) }
+                Style.CIRCLE -> { node, index -> nodeCircleCoords(NetworkMapVisualiser.NodeType.BANK, index) }
+            })
+        }
+        for ((index, serviceProvider) in (simulation.serviceProviders + simulation.regulators).withIndex()) {
+            nodesToWidgets[serviceProvider]!!.position(index, when (displayStyle) {
+                Style.MAP -> { node, index -> nodeMapCoords(node) }
+                Style.CIRCLE -> { node, index -> nodeCircleCoords(NetworkMapVisualiser.NodeType.SERVICE, index) }
+            })
+        }
+    }
+
+    fun nodeMapCoords(node: MockNetwork.MockNode): Pair<Double, Double> {
+        // For an image of the whole world, we use:
+        // return node.place.coordinate.project(mapImage.fitWidth, mapImage.fitHeight, 85.0511, -85.0511, -180.0, 180.0)
+
+        // For Europe, our bounds are: (lng,lat)
+        // bottom left: -23.2031,29.8406
+        // top right: 33.0469,64.3209
+        try {
+            return node.place.coordinate.project(view.mapImage.fitWidth, view.mapImage.fitHeight, 64.3209, 29.8406, -23.2031, 33.0469)
+        } catch(e: Exception) {
+            throw Exception("Cannot project ${node.info.identity}", e)
+        }
+    }
+
+    fun nodeCircleCoords(type: NetworkMapVisualiser.NodeType, index: Int): Pair<Double, Double> {
+        val stepRad: Double = when(type) {
+            NetworkMapVisualiser.NodeType.BANK -> 2 * Math.PI / bankCount
+            NetworkMapVisualiser.NodeType.SERVICE -> (2 * Math.PI / serviceCount)
+        }
+        val tangentRad: Double = stepRad * index + when(type) {
+            NetworkMapVisualiser.NodeType.BANK -> 0.0
+            NetworkMapVisualiser.NodeType.SERVICE -> Math.PI / 2
+        }
+        val radius = when (type) {
+            NetworkMapVisualiser.NodeType.BANK -> Math.min(view.stageWidth, view.stageHeight) / 3.5
+            NetworkMapVisualiser.NodeType.SERVICE -> Math.min(view.stageWidth, view.stageHeight) / 8
+        }
+        val xOffset = -220
+        val yOffset = -80
+        val circleX = view.stageWidth / 2 + xOffset
+        val circleY = view.stageHeight / 2 + yOffset
+        val x: Double = radius * Math.cos(tangentRad) + circleX;
+        val y: Double = radius * Math.sin(tangentRad) + circleY;
+        return Pair(x, y)
+    }
+
+    fun createNodes() {
+        bankCount = simulation.banks.size
+        serviceCount = simulation.serviceProviders.size + simulation.regulators.size
+        for ((index, bank) in simulation.banks.withIndex()) {
+            nodesToWidgets[bank] = makeNodeWidget(bank, "bank", bank.configuration.myLegalName, NetworkMapVisualiser.NodeType.BANK, index)
+        }
+        for ((index, service) in simulation.serviceProviders.withIndex()) {
+            nodesToWidgets[service] = makeNodeWidget(service, "network-service", service.configuration.myLegalName, NetworkMapVisualiser.NodeType.SERVICE, index)
+        }
+        for ((index, service) in simulation.regulators.withIndex()) {
+            nodesToWidgets[service] = makeNodeWidget(service, "regulator", service.configuration.myLegalName, NetworkMapVisualiser.NodeType.SERVICE, index + simulation.serviceProviders.size)
+        }
+    }
+
+    fun makeNodeWidget(forNode: MockNetwork.MockNode, type: String, label: String = "Bank of Bologna",
+                       nodeType: NetworkMapVisualiser.NodeType, index: Int): NodeWidget {
+        fun emitRadarPulse(initialRadius: Double, targetRadius: Double, duration: Double): Pair<Circle, Animation> {
+            val pulse = Circle(initialRadius).apply {
+                styleClass += "node-$type"
+                styleClass += "node-circle-pulse"
+            }
+            val animation = Timeline(
+                    KeyFrame(Duration.seconds(0.0),
+                            pulse.radiusProperty().keyValue(initialRadius),
+                            pulse.opacityProperty().keyValue(1.0)
+                    ),
+                    KeyFrame(Duration.seconds(duration),
+                            pulse.radiusProperty().keyValue(targetRadius),
+                            pulse.opacityProperty().keyValue(0.0)
+                    )
+            )
+            return Pair(pulse, animation)
+        }
+
+        val innerDot = Circle(10.0).apply {
+            styleClass += "node-$type"
+            styleClass += "node-circle-inner"
+        }
+        val (outerDot, pulseAnim) = emitRadarPulse(10.0, 50.0, 0.45)
+        val (longPulseOuterDot, longPulseAnim) = emitRadarPulse(10.0, 100.0, 1.45)
+        view.root.children += outerDot
+        view.root.children += longPulseOuterDot
+        view.root.children += innerDot
+
+        val nameLabel = Label(label)
+        val nameLabelRect = StackPane(nameLabel).apply {
+            styleClass += "node-label"
+            alignment = Pos.CENTER_RIGHT
+            // This magic min width depends on the longest label of all nodes we may have, which we aren't calculating.
+            // TODO: Dynamically adjust it depending on the longest label to display.
+            minWidth = 250.0
+        }
+        view.root.children += nameLabelRect
+
+        val statusLabel = Label("")
+        val statusLabelRect = StackPane(statusLabel).apply { styleClass += "node-status-label" }
+        view.root.children += statusLabelRect
+
+        val widget = NodeWidget(forNode, innerDot, outerDot, longPulseOuterDot, pulseAnim, longPulseAnim, nameLabel, statusLabel)
+        when (displayStyle) {
+            Style.CIRCLE -> widget.position(index, { node, index -> nodeCircleCoords(nodeType, index) } )
+            Style.MAP -> widget.position(index, { node, index -> nodeMapCoords(node) })
+        }
+        return widget
+    }
+
+    fun fireBulletBetweenNodes(senderNode: MockNetwork.MockNode, destNode: MockNetwork.MockNode, startType: String, endType: String) {
+        val sx = nodesToWidgets[senderNode]!!.innerDot.centerX
+        val sy = nodesToWidgets[senderNode]!!.innerDot.centerY
+        val dx = nodesToWidgets[destNode]!!.innerDot.centerX
+        val dy = nodesToWidgets[destNode]!!.innerDot.centerY
+
+        val bullet = Circle(3.0)
+        bullet.styleClass += "bullet"
+        bullet.styleClass += "connection-$startType-to-$endType"
+        with(TranslateTransition(stepDuration, bullet)) {
+            fromX = sx
+            fromY = sy
+            toX = dx
+            toY = dy
+            setOnFinished {
+                // For some reason removing/adding the bullet nodes causes an annoying 1px shift in the map view, so
+                // to avoid visual distraction we just deliberately leak the bullet node here. Obviously this is a
+                // memory leak that would break long term usage.
+                //
+                // TODO: Find root cause and fix.
+                //
+                // root.children.remove(bullet)
+                bullet.isVisible = false
+            }
+            play()
+        }
+
+        val line = Line(sx, sy, dx, dy).apply { styleClass += "message-line" }
+        // Fade in quick, then fade out slow.
+        with(FadeTransition(stepDuration.divide(5.0), line)) {
+            fromValue = 0.0
+            toValue = 1.0
+            play()
+            setOnFinished {
+                with(FadeTransition(stepDuration.multiply(6.0), line)) { fromValue = 1.0; toValue = 0.0; play() }
+            }
+        }
+
+        view.root.children.add(1, line)
+        view.root.children.add(bullet)
+    }
+
+}
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/Europe.jpg
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/Europe.jpg
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/MainWindow.fxml
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/MainWindow.fxml
@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<?import javafx.geometry.Insets?>
+<?import javafx.scene.control.Button?>
+<?import javafx.scene.control.ScrollPane?>
+<?import javafx.scene.control.SplitPane?>
+<?import javafx.scene.layout.AnchorPane?>
+<?import javafx.scene.layout.HBox?>
+<?import javafx.scene.layout.VBox?>
+
+
+<VBox maxHeight="-Infinity" maxWidth="-Infinity" minHeight="-Infinity" minWidth="-Infinity" prefHeight="400.0" prefWidth="600.0" xmlns="http://javafx.com/javafx/8.0.65" xmlns:fx="http://javafx.com/fxml/1">
+   <children>
+      <HBox alignment="CENTER_RIGHT" prefHeight="0.0" prefWidth="600.0">
+         <children>
+            <Button fx:id="nextButton" mnemonicParsing="false" onAction="#onNextClicked" text="Next" />
+         </children>
+         <padding>
+            <Insets bottom="20.0" left="20.0" right="20.0" top="20.0" />
+         </padding>
+      </HBox>
+      <SplitPane dividerPositions="0.2408026755852843" prefHeight="336.0" prefWidth="600.0" VBox.vgrow="ALWAYS">
+        <items>
+          <AnchorPane minHeight="0.0" minWidth="0.0" prefHeight="160.0" prefWidth="100.0" />
+            <ScrollPane fx:id="mapView" hbarPolicy="NEVER" pannable="true" prefHeight="200.0" prefWidth="200.0" vbarPolicy="NEVER" />
+        </items>
+      </SplitPane>
+   </children>
+</VBox>
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/R3
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/R3
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/SIL
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/SIL
@ -0,0 +1,43 @@
+Copyright 2010, 2012 Adobe Systems Incorporated (http://www.adobe.com/), with Reserved Font Name 'Source'. All Rights Reserved. Source is a trademark of Adobe Systems Incorporated in the United States and/or other countries.
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at: http://scripts.sil.org/OFL
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide development of collaborative font projects, to support the font creation efforts of academic and linguistic communities, and to provide a free and open framework in which fonts may be shared and improved in partnership with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and redistributed freely as long as they are not sold by themselves. The fonts, including any derivative works, can be bundled, embedded, redistributed and/or sold with any software provided that any reserved names are not used by derivative works. The fonts and derivatives, however, cannot be released under any other type of license. The requirement for fonts to remain under this license does not apply to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright Holder(s) under this license and clearly marked as such. This may include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting, or substituting -- in part or in whole -- any of the components of the Original Version, by changing formats or by porting the Font Software to a new environment.
+
+"Author" refers to any designer, engineer, programmer, technical writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining a copy of the Font Software, to use, study, copy, merge, embed, modify, redistribute, and sell modified and unmodified copies of the Font Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components, in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled, redistributed and/or sold with any software, provided that each copy contains the above copyright notice and this license. These can be included either as stand-alone text files, human-readable headers or in the appropriate machine-readable metadata fields within text or binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font Name(s) unless explicit written permission is granted by the corresponding Copyright Holder. This restriction only applies to the primary font name as presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font Software shall not be used to promote, endorse or advertise any Modified Version, except to acknowledge the contribution(s) of the Copyright Holder(s) and the Author(s) or with their explicit written permission.
+
+5) The Font Software, modified or unmodified, in part or in whole, must be distributed entirely under this license, and must not be distributed under any other license. The requirement for fonts to remain under this license does not apply to any document created using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER DEALINGS IN THE FONT SOFTWARE.
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-Black.otf
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-Black.otf
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-BlackIt.otf
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-BlackIt.otf
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-Bold.otf
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-Bold.otf
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-BoldIt.otf
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-BoldIt.otf
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-ExtraLight.otf
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-ExtraLight.otf
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-ExtraLightIt.otf
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-ExtraLightIt.otf
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-It.otf
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-It.otf
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-Light.otf
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-Light.otf
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-LightIt.otf
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-LightIt.otf
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-Regular.otf
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-Regular.otf
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-Semibold.otf
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-Semibold.otf
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-SemiboldIt.otf
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/SourceSansPro-SemiboldIt.otf
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/WorldMap.png
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/WorldMap.png
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/WorldMapSquare.png
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/WorldMapSquare.png
--- a/network-simulator/src/main/resources/com/r3cev/corda/netmap/styles.css
+++ b/network-simulator/src/main/resources/com/r3cev/corda/netmap/styles.css
@ -0,0 +1,227 @@
+/*
+ * Copyright 2015 Distributed Ledger Group LLC.  Distributed as Licensed Company IP to DLG Group Members
+ * pursuant to the August 7, 2015 Advisory Services Agreement and subject to the Company IP License terms 
+ * set forth therein.  
+ *
+ * All other rights reserved. 
+ */
+
+.root-pane {
+    -fx-font-family: "Source Sans Pro", sans-serif;
+    -fx-font-size: 12pt;
+}
+.node-bank {
+    -base-fill: #9e7bff;
+}
+
+.node-regulator {
+    -base-fill: #fff2d1;
+}
+
+.node-network-service {
+    -base-fill: red;
+}
+
+.node-circle-inner {
+    -fx-fill: -base-fill;
+    -fx-stroke: derive(-base-fill, -40%);
+    -fx-stroke-width: 2px;
+}
+
+.node-circle-pulse {
+    -fx-fill: radial-gradient(center 50% 50%, radius 50%, #ffffff00, derive(-base-fill, 50%));
+}
+
+.hide-sidebar-button {
+    -fx-background-color: linear-gradient(to left, #464646, derive(#1c1c1c, 10%));
+    -fx-min-width: 0;
+    -fx-text-fill: #ffffffaa;
+    -fx-alignment: top-right;
+    -fx-label-padding: 0;
+    -fx-padding: 0 10 0 10;
+    -fx-border-color: #00000066;
+    -fx-border-width: 1 0 1 1;
+}
+
+.bullet {
+    -fx-fill: black;
+}
+
+.connection-bank-to-bank {
+    -fx-fill: white;
+}
+
+.message-line {
+    -fx-stroke: white;
+}
+
+.connection-bank-to-regulator {
+    -fx-stroke: red;
+}
+
+.node-label > Label, .node-status-label > Label {
+    -fx-text-fill: white;
+    -fx-effect: dropshadow(gaussian, black, 10, 0.1, 0, 0);
+}
+
+/* Hack around the Modena theme that makes all scroll panes grey by default */
+.scroll-pane > .viewport {
+    -fx-background-color: transparent;
+}
+
+.scroll-pane .scroll-bar {
+    -fx-background-color: transparent;
+}
+
+.flat-button {
+    -fx-background-color: white;
+    -fx-padding: 0 0 0 0;
+}
+
+.flat-button:hover {
+    -fx-underline: true;
+    -fx-cursor: hand;
+}
+
+.flat-button:focused {
+    -fx-font-weight: bold;
+}
+
+.fat-buttons Button {
+    -fx-padding: 10 15 10 15;
+    -fx-min-width: 100;
+    -fx-font-weight: bold;
+    -fx-base: whitesmoke;
+}
+
+.fat-buttons ChoiceBox {
+    -fx-padding: 4 8 4 8;
+    -fx-min-width: 100;
+    -fx-font-weight: bold;
+    -fx-base: whitesmoke;
+}
+
+.fat-buttons Button:default {
+    -fx-base: orange;
+    -fx-text-fill: white;
+    -fx-font-family: 'Source Sans Pro', sans-serif;
+}
+
+.fat-buttons Button:cancel {
+    -fx-background-color: white;
+    -fx-background-insets: 1;
+    -fx-border-color: lightgray;
+    -fx-border-radius: 3;
+    -fx-text-fill: black;
+}
+
+.fat-buttons Button:cancel:hover {
+    -fx-base: white;
+    -fx-background-color: -fx-shadow-highlight-color, -fx-outer-border, -fx-inner-border, -fx-body-color;
+    -fx-text-fill: black;
+}
+
+/** take out the focus ring */
+.no-focus-button:focused {
+    -fx-background-color: -fx-shadow-highlight-color, -fx-outer-border, -fx-inner-border, -fx-body-color;
+    -fx-background-insets: 0 0 -1 0, 0, 1, 2;
+    -fx-background-radius: 3px, 3px, 2px, 1px;
+}
+
+.blue-button {
+    -fx-base: lightblue;
+    -fx-text-fill: darkslategrey;
+}
+.blue-button:disabled {
+    -fx-text-fill: white;
+}
+
+.green-button {
+    -fx-base: #62c462;
+    -fx-text-fill: darkslategrey;
+}
+.green-button:disabled {
+    -fx-text-fill: white;
+}
+
+.next-button {
+    -fx-base: #66b2ff;
+    -fx-text-fill: white;
+
+    -fx-background-color: -fx-shadow-highlight-color, -fx-outer-border, -fx-inner-border, -fx-body-color;
+    -fx-background-insets: 0 0 -1 0, 0, 1, 2;
+    -fx-background-radius: 3px, 3px, 2px, 1px;
+}
+
+.style-choice:default {
+    -fx-base: #66b2ff;
+    -fx-text-fill: white;
+
+    -fx-background-color: -fx-shadow-highlight-color, -fx-outer-border, -fx-inner-border, -fx-body-color;
+    -fx-background-insets: 0 0 -1 0, 0, 1, 2;
+    -fx-background-radius: 3px, 3px, 2px, 1px;
+}
+
+.controls-hbox {
+    -fx-background-color: white;
+}
+
+.drop-shadow-pane-horizontal {
+    /*-fx-background-color: linear-gradient(to top, #888, #fff);*/
+    -fx-background-color: white;
+    -fx-border-color: #555;
+    -fx-border-width: 0 0 1 0;
+}
+
+.logo-label {
+    -fx-font-size: 40;
+    -fx-text-fill: slategray;
+}
+
+.date-label {
+    -fx-font-size: 30;
+}
+.splitter {
+    -fx-padding: 0;
+    -fx-background-color: #464646;
+}
+.splitter > .split-pane-divider {
+    -fx-background-color: linear-gradient(to left, #1c1c1c, transparent);
+    -fx-border-color: black;
+    -fx-border-width: 0 1 0 0;
+    -fx-padding: 0 2 0 2;
+}
+
+.progress-tracker-cursor-box {
+    -fx-padding: 0 15 0 0;
+}
+
+.progress-tracker-cursor {
+    -fx-translate-x: 15.0;
+    -fx-fill: white;
+}
+
+.sidebar {
+    -fx-background-color: #464646;
+}
+
+.sidebar > VBox > StackPane {
+    -fx-background-color: #666666;
+    -fx-padding: 5px;
+}
+.sidebar > VBox > StackPane > Label {
+    -fx-text-fill: white;
+}
+
+.progress-tracker-widget-steps {
+    -fx-spacing: 5;
+    -fx-fill-width: true;
+}
+.progress-tracker-widget-steps > StackPane {
+    -fx-background-color: #5a5a5a;
+    -fx-padding: 7px;
+    -fx-alignment: center-left;
+}
+.progress-tracker-widget-steps > StackPane > Label {
+    -fx-text-fill: white;
+}
--- a/node/build.gradle
+++ b/node/build.gradle
@ -132,6 +132,8 @@ dependencies {

    // Integration test helpers
    integrationTestCompile 'junit:junit:4.12'
+
+    testCompile "com.nhaarman:mockito-kotlin:0.6.1"
 }

 quasarScan.dependsOn('classes', ':core:classes', ':contracts:classes')
--- a/node/src/main/kotlin/com/r3corda/node/internal/AbstractNode.kt
+++ b/node/src/main/kotlin/com/r3corda/node/internal/AbstractNode.kt
@ -297,10 +297,11 @@ abstract class AbstractNode(val dir: Path, val configuration: NodeConfiguration,
        }
        services.networkMapCache.addNode(info)
        // In the unit test environment, we may run without any network map service sometimes.
-        if (networkMapService == null && inNodeNetworkMapService == null)
+        if (networkMapService == null && inNodeNetworkMapService == null) {
+            services.networkMapCache.runWithoutMapService()
            return noNetworkMapConfigured()
-        else
-            return registerWithNetworkMap(networkMapService ?: info.address)
+        }
+        return registerWithNetworkMap(networkMapService ?: info.address)
    }

    private fun registerWithNetworkMap(networkMapServiceAddress: SingleMessageRecipient): ListenableFuture<Unit> {
--- a/node/src/main/kotlin/com/r3corda/node/services/api/CheckpointStorage.kt
+++ b/node/src/main/kotlin/com/r3corda/node/services/api/CheckpointStorage.kt
@ -34,4 +34,10 @@ data class Checkpoint(
        val serialisedFiber: SerializedBytes<ProtocolStateMachineImpl<*>>,
        val request: ProtocolIORequest?,
        val receivedPayload: Any?
-)
+) {
+    // This flag is always false when loaded from storage as it isn't serialised.
+    // It is used to track when the associated fiber has been created, but not necessarily started when
+    // messages for protocols arrive before the system has fully loaded at startup.
+    @Transient
+    var fiberCreated: Boolean = false
+}
--- a/node/src/main/kotlin/com/r3corda/node/services/network/InMemoryNetworkMapCache.kt
+++ b/node/src/main/kotlin/com/r3corda/node/services/network/InMemoryNetworkMapCache.kt
@ -1,5 +1,6 @@
 package com.r3corda.node.services.network

+import com.google.common.annotations.VisibleForTesting
 import com.google.common.util.concurrent.ListenableFuture
 import com.google.common.util.concurrent.MoreExecutors
 import com.google.common.util.concurrent.SettableFuture
@ -45,6 +46,9 @@ open class InMemoryNetworkMapCache : SingletonSerializeAsToken(), NetworkMapCach
        get() = registeredNodes.map { it.value }
    private val _changed = PublishSubject.create<MapChange>()
    override val changed: Observable<MapChange> = _changed
+    private val _registrationFuture = SettableFuture.create<Unit>()
+    override val mapServiceRegistered: ListenableFuture<Unit>
+        get() = _registrationFuture

    private var registeredForPush = false
    protected var registeredNodes = Collections.synchronizedMap(HashMap<Party, NodeInfo>())
@ -82,6 +86,7 @@ open class InMemoryNetworkMapCache : SingletonSerializeAsToken(), NetworkMapCach
        // Add a message handler for the response, and prepare a future to put the data into.
        // Note that the message handler will run on the network thread (not this one).
        val future = SettableFuture.create<Unit>()
+        _registrationFuture.setFuture(future)
        net.runOnNextMessage(NetworkMapService.FETCH_PROTOCOL_TOPIC, sessionID, MoreExecutors.directExecutor()) { message ->
            val resp = message.data.deserialize<NetworkMapService.FetchMapResponse>()
            // We may not receive any nodes back, if the map hasn't changed since the version specified
@ -120,6 +125,7 @@ open class InMemoryNetworkMapCache : SingletonSerializeAsToken(), NetworkMapCach
        // Add a message handler for the response, and prepare a future to put the data into.
        // Note that the message handler will run on the network thread (not this one).
        val future = SettableFuture.create<Unit>()
+        _registrationFuture.setFuture(future)
        net.runOnNextMessage(NetworkMapService.SUBSCRIPTION_PROTOCOL_TOPIC, sessionID, MoreExecutors.directExecutor()) { message ->
            val resp = message.data.deserialize<NetworkMapService.SubscribeResponse>()
            if (resp.confirmed) {
@ -151,4 +157,9 @@ open class InMemoryNetworkMapCache : SingletonSerializeAsToken(), NetworkMapCach
            AddOrRemove.REMOVE -> removeNode(reg.node)
        }
    }
+
+    @VisibleForTesting
+    override fun runWithoutMapService() {
+        _registrationFuture.set(Unit)
+    }
 }
--- a/node/src/main/kotlin/com/r3corda/node/services/statemachine/StateMachineManager.kt
+++ b/node/src/main/kotlin/com/r3corda/node/services/statemachine/StateMachineManager.kt
@ -14,6 +14,7 @@ import com.r3corda.core.messaging.send
 import com.r3corda.core.protocols.ProtocolLogic
 import com.r3corda.core.protocols.ProtocolStateMachine
 import com.r3corda.core.serialization.*
+import com.r3corda.core.then
 import com.r3corda.core.utilities.ProgressTracker
 import com.r3corda.core.utilities.trace
 import com.r3corda.node.services.api.Checkpoint
@ -73,6 +74,7 @@ class StateMachineManager(val serviceHub: ServiceHubInternal, tokenizableService
    private val checkpointingMeter = metrics.meter("Protocols.Checkpointing Rate")
    private val totalStartedProtocols = metrics.counter("Protocols.Started")
    private val totalFinishedProtocols = metrics.counter("Protocols.Finished")
+    private var started = false

    // Context for tokenized services in checkpoints
    private val serializationContext = SerializeAsTokenContext(tokenizableServices, quasarKryo())
@ -118,13 +120,23 @@ class StateMachineManager(val serviceHub: ServiceHubInternal, tokenizableService
    }

    fun start() {
-        checkpointStorage.checkpoints.forEach { restoreFromCheckpoint(it) }
+        checkpointStorage.checkpoints.forEach { createFiberForCheckpoint(it) }
+        serviceHub.networkMapCache.mapServiceRegistered.then(executor) {
+            synchronized(started) {
+                started = true
+                stateMachines.forEach { restartFiber(it.key, it.value) }
+            }
+        }
    }

-    private fun restoreFromCheckpoint(checkpoint: Checkpoint) {
-        val fiber = deserializeFiber(checkpoint.serialisedFiber)
-        initFiber(fiber, { checkpoint })
+    private fun createFiberForCheckpoint(checkpoint: Checkpoint) {
+        if (!checkpoint.fiberCreated) {
+            val fiber = deserializeFiber(checkpoint.serialisedFiber)
+            initFiber(fiber, { checkpoint })
+        }
+    }

+    private fun restartFiber(fiber: ProtocolStateMachineImpl<*>, checkpoint: Checkpoint) {
        if (checkpoint.request is ReceiveRequest<*>) {
            val topicSession = checkpoint.request.receiveTopicSession
            fiber.logger.info("Restored ${fiber.logic} - it was previously waiting for message of type ${checkpoint.request.receiveType.name} on $topicSession")
@ -179,7 +191,7 @@ class StateMachineManager(val serviceHub: ServiceHubInternal, tokenizableService
        }
    }

-    private fun initFiber(psm: ProtocolStateMachineImpl<*>, startingCheckpoint: () -> Checkpoint) {
+    private fun initFiber(psm: ProtocolStateMachineImpl<*>, startingCheckpoint: () -> Checkpoint): Checkpoint {
        psm.serviceHub = serviceHub
        psm.suspendAction = { request ->
            psm.logger.trace { "Suspended fiber ${psm.id} ${psm.logic}" }
@ -194,8 +206,12 @@ class StateMachineManager(val serviceHub: ServiceHubInternal, tokenizableService
            totalFinishedProtocols.inc()
            notifyChangeObservers(psm, AddOrRemove.REMOVE)
        }
-        stateMachines[psm] = startingCheckpoint()
+        val checkpoint = startingCheckpoint()
+        checkpoint.fiberCreated = true
+        totalStartedProtocols.inc()
+        stateMachines[psm] = checkpoint
        notifyChangeObservers(psm, AddOrRemove.ADD)
+        return checkpoint
    }

    /**
@ -206,17 +222,22 @@ class StateMachineManager(val serviceHub: ServiceHubInternal, tokenizableService
    fun <T> add(loggerName: String, logic: ProtocolLogic<T>): ProtocolStateMachine<T> {
        val fiber = ProtocolStateMachineImpl(logic, scheduler, loggerName)
        // Need to add before iterating in case of immediate completion
-        initFiber(fiber) {
+        val checkpoint = initFiber(fiber) {
            val checkpoint = Checkpoint(serializeFiber(fiber), null, null)
-            checkpointStorage.addCheckpoint(checkpoint)
            checkpoint
        }
+        checkpointStorage.addCheckpoint(checkpoint)
+        synchronized(started) { // If we are not started then our checkpoint will be picked up during start
+            if (!started) {
+                return fiber
+            }
+        }
+
        try {
            executor.executeASAP {
                iterateStateMachine(fiber, null) {
                    fiber.start()
                }
-                totalStartedProtocols.inc()
            }
        } catch (e: ExecutionException) {
            // There are two ways we can take exceptions in this method:
--- a/node/src/main/kotlin/com/r3corda/node/utilities/certsigning/CertificateSigner.kt
+++ b/node/src/main/kotlin/com/r3corda/node/utilities/certsigning/CertificateSigner.kt
@ -0,0 +1,133 @@
+package com.r3corda.node.utilities.certsigning
+
+import com.r3corda.core.crypto.X509Utilities
+import com.r3corda.core.crypto.X509Utilities.CORDA_CLIENT_CA
+import com.r3corda.core.crypto.X509Utilities.CORDA_CLIENT_CA_PRIVATE_KEY
+import com.r3corda.core.crypto.X509Utilities.CORDA_ROOT_CA
+import com.r3corda.core.crypto.X509Utilities.addOrReplaceCertificate
+import com.r3corda.core.crypto.X509Utilities.addOrReplaceKey
+import com.r3corda.core.div
+import com.r3corda.core.minutes
+import com.r3corda.core.utilities.loggerFor
+import com.r3corda.node.services.config.FullNodeConfiguration
+import com.r3corda.node.services.config.NodeConfiguration
+import com.r3corda.node.services.messaging.ArtemisMessagingComponent
+import joptsimple.OptionParser
+import java.nio.file.Files
+import java.nio.file.Path
+import java.nio.file.Paths
+import java.security.KeyPair
+import java.security.cert.Certificate
+import kotlin.system.exitProcess
+
+/**
+ * This check the [certificatePath] for certificates required to connect to the Corda network.
+ * If the certificates are not found, a [PKCS10CertificationRequest] will be submitted to Corda network permissioning server using [CertificateSigningService].
+ * This process will enter a slow polling loop until the request has been approved, and then
+ * the certificate chain will be downloaded and stored in [KeyStore] reside in [certificatePath].
+ */
+class CertificateSigner(certificatePath: Path, val nodeConfig: NodeConfiguration, val certService: CertificateSigningService) : ArtemisMessagingComponent(certificatePath, nodeConfig) {
+    companion object {
+        val pollInterval = 1.minutes
+        val log = loggerFor<CertificateSigner>()
+    }
+
+    fun buildKeyStore() {
+        val caKeyStore = X509Utilities.loadOrCreateKeyStore(keyStorePath, config.keyStorePassword)
+
+        if (!caKeyStore.containsAlias(CORDA_CLIENT_CA)) {
+            // No certificate found in key store, create certificate signing request and post request to signing server.
+            log.info("No certificate found in key store, creating certificate signing request...")
+
+            // Create or load key pair from the key store.
+            val keyPair = X509Utilities.loadOrCreateKeyPairFromKeyStore(keyStorePath, config.keyStorePassword,
+                    config.keyStorePassword, CORDA_CLIENT_CA_PRIVATE_KEY) {
+                X509Utilities.createSelfSignedCACert(nodeConfig.myLegalName)
+            }
+            log.info("Submitting certificate signing request to Corda certificate signing server.")
+            val requestId = submitCertificateSigningRequest(keyPair)
+            log.info("Successfully submitted request to Corda certificate signing server, request ID : $requestId")
+            log.info("Start polling server for certificate signing approval.")
+            val certificates = pollServerForCertificates(requestId)
+            log.info("Certificate signing request approved, installing new certificates.")
+
+            // Save private key and certificate chain to the key store.
+            caKeyStore.addOrReplaceKey(CORDA_CLIENT_CA_PRIVATE_KEY, keyPair.private,
+                    config.keyStorePassword.toCharArray(), certificates)
+
+            // Assumes certificate chain always starts with client certificate and end with root certificate.
+            caKeyStore.addOrReplaceCertificate(CORDA_CLIENT_CA, certificates.first())
+
+            X509Utilities.saveKeyStore(caKeyStore, keyStorePath, config.keyStorePassword)
+
+            // Save certificates to trust store.
+            val trustStore = X509Utilities.loadOrCreateKeyStore(trustStorePath, config.trustStorePassword)
+
+            // Assumes certificate chain always starts with client certificate and end with root certificate.
+            trustStore.addOrReplaceCertificate(CORDA_ROOT_CA, certificates.last())
+
+            X509Utilities.saveKeyStore(trustStore, trustStorePath, config.trustStorePassword)
+        } else {
+            log.trace("Certificate already exists, exiting certificate signer...")
+        }
+    }
+
+    /**
+     * Poll Certificate Signing Server for approved certificate,
+     * enter a slow polling loop if server return null.
+     * @param requestId Certificate signing request ID.
+     * @return Map of certificate chain.
+     */
+    private fun pollServerForCertificates(requestId: String): Array<Certificate> {
+        // Poll server to download the signed certificate once request has been approved.
+        var certificates = certService.retrieveCertificates(requestId)
+
+        while (certificates == null) {
+            Thread.sleep(pollInterval.toMillis())
+            certificates = certService.retrieveCertificates(requestId)
+        }
+        return certificates
+    }
+
+    /**
+     * Submit Certificate Signing Request to Certificate signing service if request ID not found in file system
+     * New request ID will be stored in requestId.txt
+     * @param keyPair Public Private key pair generated for SSL certification.
+     * @return Request ID return from the server.
+     */
+    private fun submitCertificateSigningRequest(keyPair: KeyPair): String {
+        val requestIdStore = certificatePath / "certificate-request-id.txt"
+        // Retrieve request id from file if exists, else post a request to server.
+        return if (!Files.exists(requestIdStore)) {
+            val request = X509Utilities.createCertificateSigningRequest(nodeConfig.myLegalName, nodeConfig.nearestCity, nodeConfig.emailAddress, keyPair)
+            // Post request to signing server via http.
+            val requestId = certService.submitRequest(request)
+            // Persists request ID to file in case of node shutdown.
+            Files.write(requestIdStore, listOf(requestId), Charsets.UTF_8)
+            requestId
+        } else {
+            Files.readAllLines(requestIdStore).first()
+        }
+    }
+}
+
+object ParamsSpec {
+    val parser = OptionParser()
+    val baseDirectoryArg = parser.accepts("base-dir", "The directory to put all key stores under").withRequiredArg()
+    val configFileArg = parser.accepts("config-file", "The path to the config file").withRequiredArg()
+}
+
+fun main(args: Array<String>) {
+    val cmdlineOptions = try {
+        ParamsSpec.parser.parse(*args)
+    } catch (ex: Exception) {
+        CertificateSigner.log.error("Unable to parse args", ex)
+        exitProcess(1)
+    }
+    val baseDirectoryPath = Paths.get(cmdlineOptions.valueOf(ParamsSpec.baseDirectoryArg) ?: throw IllegalArgumentException("Please provide Corda node base directory path"))
+    val configFile = if (cmdlineOptions.has(ParamsSpec.configFileArg)) Paths.get(cmdlineOptions.valueOf(ParamsSpec.configFileArg)) else null
+    val conf = FullNodeConfiguration(NodeConfiguration.loadConfig(baseDirectoryPath, configFile, allowMissingConfig = true))
+    // TODO: Use HTTPS instead
+    CertificateSigner(baseDirectoryPath / "certificate", conf, HTTPCertificateSigningService(conf.certificateSigningService)).buildKeyStore()
+}
+
--- a/node/src/main/kotlin/com/r3corda/node/utilities/certsigning/CertificateSigningService.kt
+++ b/node/src/main/kotlin/com/r3corda/node/utilities/certsigning/CertificateSigningService.kt
@ -0,0 +1,11 @@
+package com.r3corda.node.utilities.certsigning
+
+import org.bouncycastle.pkcs.PKCS10CertificationRequest
+import java.security.cert.Certificate
+
+interface CertificateSigningService {
+    /** Submits a CSR to the signing service and returns an opaque request ID. */
+    fun submitRequest(request: PKCS10CertificationRequest): String
+    /** Poll Certificate Signing Server for the request and returns a chain of certificates if request has been approved, null otherwise. */
+    fun retrieveCertificates(requestId: String): Array<Certificate>?
+}
--- a/node/src/main/kotlin/com/r3corda/node/utilities/certsigning/HTTPCertificateSigningService.kt
+++ b/node/src/main/kotlin/com/r3corda/node/utilities/certsigning/HTTPCertificateSigningService.kt
@ -0,0 +1,59 @@
+package com.r3corda.node.utilities.certsigning
+
+import com.google.common.net.HostAndPort
+import org.apache.commons.io.IOUtils
+import org.bouncycastle.pkcs.PKCS10CertificationRequest
+import java.io.IOException
+import java.net.HttpURLConnection
+import java.net.URL
+import java.security.cert.Certificate
+import java.security.cert.CertificateFactory
+import java.util.*
+import java.util.zip.ZipInputStream
+
+class HTTPCertificateSigningService(val server: HostAndPort) : CertificateSigningService {
+    companion object {
+        // TODO: Propagate version information from gradle
+        val clientVersion = "1.0"
+    }
+
+    override fun retrieveCertificates(requestId: String): Array<Certificate>? {
+        // Poll server to download the signed certificate once request has been approved.
+        val url = URL("http://$server/api/certificate/$requestId")
+
+        val conn = url.openConnection() as HttpURLConnection
+        conn.requestMethod = "GET"
+
+        return when (conn.responseCode) {
+            HttpURLConnection.HTTP_OK -> conn.inputStream.use {
+                ZipInputStream(it).use {
+                    val certificates = ArrayList<Certificate>()
+                    while (it.nextEntry != null) {
+                        certificates.add(CertificateFactory.getInstance("X.509").generateCertificate(it))
+                    }
+                    certificates.toTypedArray()
+                }
+            }
+            HttpURLConnection.HTTP_NO_CONTENT -> null
+            HttpURLConnection.HTTP_UNAUTHORIZED -> throw IOException("Certificate signing request has been rejected, please contact Corda network administrator for more information.")
+            else -> throw IOException("Unexpected response code ${conn.responseCode} - ${IOUtils.toString(conn.errorStream)}")
+        }
+    }
+
+    override fun submitRequest(request: PKCS10CertificationRequest): String {
+        // Post request to certificate signing server via http.
+        val conn = URL("http://$server/api/certificate").openConnection() as HttpURLConnection
+        conn.doOutput = true
+        conn.requestMethod = "POST"
+        conn.setRequestProperty("Content-Type", "application/octet-stream")
+        conn.setRequestProperty("Client-Version", clientVersion)
+        conn.outputStream.write(request.encoded)
+
+        return when (conn.responseCode) {
+            HttpURLConnection.HTTP_OK -> IOUtils.toString(conn.inputStream)
+            HttpURLConnection.HTTP_FORBIDDEN -> throw IOException("Client version $clientVersion is forbidden from accessing permissioning server, please upgrade to newer version.")
+            else -> throw IOException("Unexpected response code ${conn.responseCode} - ${IOUtils.toString(conn.errorStream)}")
+        }
+
+    }
+}
--- a/node/src/main/resources/com/r3corda/node/internal/certificates/cordadevcakeys.jks
+++ b/node/src/main/resources/com/r3corda/node/internal/certificates/cordadevcakeys.jks
--- a/node/src/main/resources/com/r3corda/node/internal/certificates/cordatruststore.jks
+++ b/node/src/main/resources/com/r3corda/node/internal/certificates/cordatruststore.jks
--- a/node/src/test/kotlin/com/r3corda/node/services/NodeSchedulerServiceTest.kt
+++ b/node/src/test/kotlin/com/r3corda/node/services/NodeSchedulerServiceTest.kt
@ -91,6 +91,7 @@ class NodeSchedulerServiceTest : SingletonSerializeAsToken() {
                smmHasRemovedAllProtocols.countDown()
            }
        }
+        mockSMM.start()
        services.smm = mockSMM
    }

--- a/node/src/test/kotlin/com/r3corda/node/services/statemachine/StateMachineManagerTests.kt
+++ b/node/src/test/kotlin/com/r3corda/node/services/statemachine/StateMachineManagerTests.kt
@ -13,6 +13,8 @@ import org.assertj.core.api.Assertions.assertThat
 import org.junit.After
 import org.junit.Before
 import org.junit.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertTrue

 class StateMachineManagerTests {

@ -62,13 +64,72 @@ class StateMachineManagerTests {
        assertThat(restoredProtocol.receivedPayload).isEqualTo(payload)
    }

+    @Test
+    fun `protocol added before network map does run after init`() {
+        val node3 = net.createNode(node1.info.address) //create vanilla node
+        val protocol = ProtocolNoBlocking()
+        node3.smm.add("test", protocol)
+        assertEquals(false, protocol.protocolStarted) // Not started yet as no network activity has been allowed yet
+        net.runNetwork() // Allow network map messages to flow
+        assertEquals(true, protocol.protocolStarted) // Now we should have run the protocol
+    }
+
+    @Test
+    fun `protocol added before network map will be init checkpointed`() {
+        var node3 = net.createNode(node1.info.address) //create vanilla node
+        val protocol = ProtocolNoBlocking()
+        node3.smm.add("test", protocol)
+        assertEquals(false, protocol.protocolStarted) // Not started yet as no network activity has been allowed yet
+        node3.stop()
+
+        node3 = net.createNode(node1.info.address, forcedID = node3.id)
+        val restoredProtocol = node3.smm.findStateMachines(ProtocolNoBlocking::class.java).single().first
+        assertEquals(false, restoredProtocol.protocolStarted) // Not started yet as no network activity has been allowed yet
+        net.runNetwork() // Allow network map messages to flow
+        node3.smm.executor.flush()
+        assertEquals(true, restoredProtocol.protocolStarted) // Now we should have run the protocol and hopefully cleared the init checkpoint
+        node3.stop()
+
+        // Now it is completed the protocol should leave no Checkpoint.
+        node3 = net.createNode(node1.info.address, forcedID = node3.id)
+        net.runNetwork() // Allow network map messages to flow
+        node3.smm.executor.flush()
+        assertTrue(node3.smm.findStateMachines(ProtocolNoBlocking::class.java).isEmpty())
+    }
+
+    @Test
+    fun `protocol loaded from checkpoint will respond to messages from before start`() {
+        val topic = "send-and-receive"
+        val payload = random63BitValue()
+        val sendProtocol = SendProtocol(topic, node2.info.identity, payload)
+        val receiveProtocol = ReceiveProtocol(topic, node1.info.identity)
+        connectProtocols(sendProtocol, receiveProtocol)
+        node2.smm.add("test", receiveProtocol) // Prepare checkpointed receive protocol
+        node2.stop() // kill receiver
+        node1.smm.add("test", sendProtocol) // now generate message to spool up and thus come in ahead of messages for NetworkMapService
+        val restoredProtocol = node2.restartAndGetRestoredProtocol<ReceiveProtocol>(node1.info.address)
+        assertThat(restoredProtocol.receivedPayload).isEqualTo(payload)
+    }
+
    private inline fun <reified P : NonTerminatingProtocol> MockNode.restartAndGetRestoredProtocol(networkMapAddress: SingleMessageRecipient? = null): P {
        val servicesArray = advertisedServices.toTypedArray()
        val node = mockNet.createNode(networkMapAddress, id, advertisedServices = *servicesArray)
+        mockNet.runNetwork() // allow NetworkMapService messages to stabilise and thus start the state machine
        return node.smm.findStateMachines(P::class.java).single().first
    }


+    private class ProtocolNoBlocking : ProtocolLogic<Unit>() {
+        @Transient var protocolStarted = false
+
+        @Suspendable
+        override fun call() {
+            protocolStarted = true
+        }
+
+        override val topic: String get() = throw UnsupportedOperationException()
+    }
+
    private class ProtocolWithoutCheckpoints : NonTerminatingProtocol() {

        @Transient var protocolStarted = false
--- a/node/src/test/kotlin/com/r3corda/node/utilities/certsigning/CertificateSignerTest.kt
+++ b/node/src/test/kotlin/com/r3corda/node/utilities/certsigning/CertificateSignerTest.kt
@ -0,0 +1,81 @@
+package com.r3corda.node.utilities.certsigning
+
+import com.google.common.net.HostAndPort
+import com.nhaarman.mockito_kotlin.any
+import com.nhaarman.mockito_kotlin.eq
+import com.nhaarman.mockito_kotlin.mock
+import com.r3corda.core.crypto.SecureHash
+import com.r3corda.core.crypto.X509Utilities
+import com.r3corda.core.div
+import com.r3corda.node.services.config.NodeConfiguration
+import org.junit.Rule
+import org.junit.Test
+import org.junit.rules.TemporaryFolder
+import java.nio.file.Files
+import kotlin.test.assertEquals
+import kotlin.test.assertFalse
+import kotlin.test.assertTrue
+
+class CertificateSignerTest {
+    @Rule
+    @JvmField
+    val tempFolder: TemporaryFolder = TemporaryFolder()
+
+    @Test
+    fun buildKeyStore() {
+
+        val id = SecureHash.randomSHA256().toString()
+
+        val certs = arrayOf(X509Utilities.createSelfSignedCACert("CORDA_CLIENT_CA").certificate,
+                X509Utilities.createSelfSignedCACert("CORDA_INTERMEDIATE_CA").certificate,
+                X509Utilities.createSelfSignedCACert("CORDA_ROOT_CA").certificate)
+
+        val certService: CertificateSigningService = mock {
+            on { submitRequest(any()) }.then { id }
+            on { retrieveCertificates(eq(id)) }.then { certs }
+        }
+
+        val keyStore = tempFolder.root.toPath().resolve("sslkeystore.jks")
+        val tmpTrustStore = tempFolder.root.toPath().resolve("truststore.jks")
+
+        assertFalse(Files.exists(keyStore))
+        assertFalse(Files.exists(tmpTrustStore))
+
+        val config = object : NodeConfiguration {
+            override val myLegalName: String = "me"
+            override val nearestCity: String = "London"
+            override val emailAddress: String = ""
+            override val devMode: Boolean = true
+            override val exportJMXto: String = ""
+            override val keyStorePassword: String = "testpass"
+            override val trustStorePassword: String = "trustpass"
+            override val certificateSigningService: HostAndPort = HostAndPort.fromParts("localhost", 0)
+        }
+
+        CertificateSigner(tempFolder.root.toPath(), config, certService).buildKeyStore()
+
+        assertTrue(Files.exists(keyStore))
+        assertTrue(Files.exists(tmpTrustStore))
+
+        X509Utilities.loadKeyStore(keyStore, config.keyStorePassword).run {
+            assertTrue(containsAlias(X509Utilities.CORDA_CLIENT_CA_PRIVATE_KEY))
+            assertTrue(containsAlias(X509Utilities.CORDA_CLIENT_CA))
+            assertFalse(containsAlias(X509Utilities.CORDA_INTERMEDIATE_CA))
+            assertFalse(containsAlias(X509Utilities.CORDA_INTERMEDIATE_CA_PRIVATE_KEY))
+            assertFalse(containsAlias(X509Utilities.CORDA_ROOT_CA))
+            assertFalse(containsAlias(X509Utilities.CORDA_ROOT_CA_PRIVATE_KEY))
+        }
+
+        X509Utilities.loadKeyStore(tmpTrustStore, config.trustStorePassword).run {
+            assertFalse(containsAlias(X509Utilities.CORDA_CLIENT_CA_PRIVATE_KEY))
+            assertFalse(containsAlias(X509Utilities.CORDA_CLIENT_CA))
+            assertFalse(containsAlias(X509Utilities.CORDA_INTERMEDIATE_CA))
+            assertFalse(containsAlias(X509Utilities.CORDA_INTERMEDIATE_CA_PRIVATE_KEY))
+            assertTrue(containsAlias(X509Utilities.CORDA_ROOT_CA))
+            assertFalse(containsAlias(X509Utilities.CORDA_ROOT_CA_PRIVATE_KEY))
+        }
+
+        assertEquals(id, Files.readAllLines(tempFolder.root.toPath() / "certificate-request-id.txt").first())
+    }
+
+}
--- a/settings.gradle
+++ b/settings.gradle
@ -5,4 +5,5 @@ include 'core'
 include 'node'
 include 'client'
 include 'experimental'
-include 'test-utils'
+include 'test-utils'
+include 'network-simulator'
--- a/test-utils/src/main/kotlin/com/r3corda/testing/node/MockNetworkMapCache.kt
+++ b/test-utils/src/main/kotlin/com/r3corda/testing/node/MockNetworkMapCache.kt
@ -22,6 +22,7 @@ class MockNetworkMapCache() : com.r3corda.node.services.network.InMemoryNetworkM
        val mockNodeB = NodeInfo(MockAddress("bankD:8080"), Party("Bank D", DummyPublicKey("Bank D")))
        registeredNodes[mockNodeA.identity] = mockNodeA
        registeredNodes[mockNodeB.identity] = mockNodeB
+        runWithoutMapService()
    }

    /**