ndncert

One question is how to let the user type in PIN code after it runs the command-line tool?
I assume it still needs some interaction?

The issue description clearly says "configuration choices and certificate parameters", it says nothing about PIN entry or any other challenge. Moreover, you cannot have a general rule for challenges, since their interaction requirements are highly dependent on the specific challenge type. Some (but not all) challenges are inherently interactive. In any case, that's outside the scope of this issue.

Here is a design:

The user will be asked to

1. read the client config, figuring out the ca-name he wants and required probe-info
2. run the ndncert-client with parameters (i)ca-name, (ii)probe-info, (iii)expected validity (has default value) period time
3. run another command-line tool ndncert-client-challenge when the PIN code or whatever things are obtained and fetch the certificate back.

A database/file directory will be used to keep the state of ongoing applications.