在对等节点上创建通道失败

Question

官方hyperledger fabric v1.0.0使用docker给出了一个简单的demo。这里是 link.

我所做的是避免 docker 并直接运行他们在机器上。多亏了我上一个问题的答案，我已经成功地启动了 1 个独立订购者和两个同行，每个都来自一个组织。

这是订购者配置的一部分 orderer.yaml，我确信与 tls 相关的路径设置正确。

General:

    # Ledger Type: The ledger type to provide to the orderer.
    # Two non-production ledger types are provided for test purposes only:
    #  - ram: An in-memory ledger whose contents are lost on restart.
    #  - json: A simple file ledger that writes blocks to disk in JSON format.
    # Only one production ledger type is provided:
    #  - file: A production file-based ledger.
    LedgerType: file

    # Listen address: The IP on which to bind to listen.
    ListenAddress: 127.0.0.1

    # Listen port: The port on which to bind to listen.
    ListenPort: 7040

    # TLS: TLS settings for the GRPC server.
    TLS:
        Enabled: true
        PrivateKey: ordererOrganizations/example.com/orderers/orderer.example.com/tls/server.key
        Certificate: ordererOrganizations/example.com/orderers/orderer.example.com/tls/server.crt
        RootCAs:
          - ordererOrganizations/example.com/orderers/orderer.example.com/tls/ca.crt
        ClientAuthEnabled: false
        ClientRootCAs:

    # Log Level: The level at which to log. This accepts logging specifications
    # per: fabric/docs/Setup/logging-control.md
    LogLevel: debug

但是，当我想使用如下命令创建频道时：

export FABRIC_CFG_PATH=$PWD
export CHANNEL_NAME=my_channel
export CORE_PEER_LOCALMSPID="Org1MSP"

export CORE_PEER_TLS_ROOTCERT_FILE=crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt

export CORE_PEER_MSPCONFIGPATH=crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp

export CORE_PEER_ADDRESS=127.0.0.1:7001

peer channel create -o 127.0.0.1:7040 -c $CHANNEL_NAME -f channel-artifacts/channel.tx --tls true --cafile $ORDERER_CA >&log.txt

日志报错如下：

Error: Error connecting due to  rpc error: code = Internal desc = connection error: desc = "transport: authentication handshake failed: x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs"

我认为这与 tls 配置问题有关。我对它不是很熟悉。谁能帮我解决这个简单的问题并给我一个简单的解释？

Answer 1

该错误是由于TLS层的主机名验证失败造成的。 TLS 证书没有 IP 主题备用名称 (SAN) - 它们只有基于 DNS 的 SAN。

最简单的方法就是将主机条目添加到您的 /etc/hosts 文件中（假设您运行在 Linux 或者苹果系统）。假设您运行一切都在同一台机器上，那么将以下行添加到您的 /etc/hosts 应该可以解决您的问题：

127.0.0.1       localhost orderer peer0.org1.example.com peer0.org2.example.com

然后确保使用主机名而不是 IP 地址：

export FABRIC_CFG_PATH=$PWD
export CHANNEL_NAME=my_channel
export CORE_PEER_LOCALMSPID="Org1MSP"

export CORE_PEER_TLS_ROOTCERT_FILE=crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt

export CORE_PEER_MSPCONFIGPATH=crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp

export CORE_PEER_ADDRESS=peer0.org1.example.com:7001

peer channel create -o orderer:7040 -c $CHANNEL_NAME -f channel-artifacts/channel.tx --tls true --cafile $ORDERER_CA >&log.txt

在对等节点上创建通道失败

Create channel on peer fails

hyperledger

hyperledger-fabric