Hyperledger Fabric 面临难以设置中间 CA

Question

我正在尝试为我的项目创建中间 CA，我有一个根 CA 和一个带有中间 CA 配置文件的中间 CA，如下所示。我在为中间 CA 创建 keypairs/MSP 和 tls 证书时遇到问题，无法将配置文件传递给中间 CA。我遵循的步骤

运行使用引导管理员管理 Root CA 容器。
注册为 org1 的 CA 管理员生成 MSP 的管理员

fabric-ca-client enroll -u https://admin:adminpw@localhost:7054 --caname ca-org1 --tls.certfiles ${PWD}/organizations/fabric-ca/org1/tls-cert.pem

使用以下命令将中间 CA 注册到根 CA

fabric-ca-client register --caname ca-org1 --id.name ica --id.attrs '"hf.Registrar.Roles=user,peer",hf.Revoker=true,hf.IntermediateCA=true' --id.secret icapw --tls.certfiles ${PWD}/organizations/fabric-ca/org1/tls-cert.pem

运行中间 CA 容器，如下所示，使用以下配置文件。
注册中级 CA

fabric-ca-client enroll -u https://icaadmin:icaadminpw@localhost:6054 --caname ica-org1 --tls.certfiles ${PWD}/organizations/fabric-ca/icaOrg1/tls-cert.pem

根 CA

version: "2"

networks:
  test:

services:
  ca_org1:
    image: hyperledger/fabric-ca:$IMAGE_TAG
    environment:
      - FABRIC_CA_HOME=/etc/hyperledger/fabric-ca-server
      - FABRIC_CA_SERVER_CA_NAME=ca-org1
      - FABRIC_CA_SERVER_TLS_ENABLED=true
      - FABRIC_CA_SERVER_PORT=7054
    ports:
      - "7054:7054"
    command: sh -c 'fabric-ca-server start -b admin:adminpw -d'
    volumes:
      - ../organizations/fabric-ca/org1:/etc/hyperledger/fabric-ca-server
    container_name: ca_org1
    networks:
      - test

中级 CA

version: "2"

networks:
  test:

services:
  ica-org1:
    image: hyperledger/fabric-ca
    environment:
      - FABRIC_CA_HOME=/etc/hyperledger/fabric-ca-server
      - FABRIC_CA_SERVER_CA_NAME=ica-org1
      - FABRIC_CA_SERVER_TLS_ENABLED=true
      - FABRIC_LOGGING_SPEC=debug
      - FABRIC_CA_SERVER_PORT=6054
    ports:
      - "6054:6054"
    command: sh -c 'fabric-ca-server start  -b icaadmin:icaadminpw -u -d http://ica:icapw@ca-org1:7054'
    volumes:
      - ../organizations/fabric-ca/icaOrg1:/etc/hyperledger/fabric-ca-server
    container_name: ica-org1
    networks:
     - test

ICA 架构配置文件



# Version of config file
version: 1.2.0

# Server's listening port (default: 7054)
port: 7054

# Enables debug logging (default: false)
debug: false

# Size limit of an acceptable CRL in bytes (default: 512000)
crlsizelimit: 512000

tls:
  # Enable TLS (default: false)
  enabled: true
  # TLS for the server's listening port
  certfile:
  keyfile:
  clientauth:
    type: noclientcert
    certfiles:

ca:
  # Name of this CA
  name: ica.org1.example.com
  # Key file (is only used to import a private key into BCCSP)
  keyfile:
  # Certificate file (default: ca-cert.pem)
  certfile:
  # Chain file
  chainfile:

crl:
  # Specifies expiration for the generated CRL. The number of hours
  # specified by this property is added to the UTC time, the resulting time
  # is used to set the 'Next Update' date of the CRL.
  expiry: 24h


registry:
  # Maximum number of times a password/secret can be reused for enrollment
  # (default: -1, which means there is no limit)
  maxenrollments: -1

  # Contains identity information which is used when LDAP is disabled
  identities:
    - name: icaadmin
      pass: icaadminpw
      type: client
      affiliation: ""
      attrs:
        hf.Registrar.Roles: "client,peer,user,member"
        hf.Registrar.DelegateRoles: "client,peer,user,member"
        hf.Revoker: true
        hf.IntermediateCA: true
        hf.GenCRL: true
        hf.Registrar.Attributes: "*"
        hf.AffiliationMgr: true


db:
  type: sqlite3
  datasource: fabric-ca-server.db
  tls:
    enabled: false
    certfiles:
    client:
      certfile:
      keyfile:

ldap:
  # Enables or disables the LDAP client (default: false)
  # If this is set to true, the "registry" section is ignored.
  enabled: false
  # The URL of the LDAP server
  url: ldap://<adminDN>:<adminPassword>@<host>:<port>/<base>
  # TLS configuration for the client connection to the LDAP server
  tls:
    certfiles:
    client:
      certfile:
      keyfile:
  # Attribute related configuration for mapping from LDAP entries to Fabric CA attributes
  attribute:

    names: ["uid", "member"]
    converters:
      - name:
        value:
    maps:
      groups:
        - name:
          value:

affiliations:
  org1:
    - department1
    - department2

signing:
  default:
    usage:
      - digital signature
    expiry: 8760h
  profiles:
    ca:
      usage:
        - cert sign
        - crl sign
      expiry: 43800h
      caconstraint:
        isca: true
        maxpathlen: 0
    tls:
      usage:
        - signing
        - key encipherment
        - server auth
        - client auth
        - key agreement
      expiry: 8760h

csr:
  cn: ica.org1.example.com
  names:
    - C: US
      ST: "North Carolina"
      L: "Durham"
      O: org1.example.com
      OU:
  hosts:
    - localhost
    - org1.example.com
  ca:
    expiry: 131400h
    pathlength: 1

#############################################################################
# BCCSP (BlockChain Crypto Service Provider) section is used to select which
# crypto library implementation to use
#############################################################################
bccsp:
  default: SW
  sw:
    hash: SHA2
    security: 256
    filekeystore:
      # The directory used for the software file-based keystore
      keystore: msp/keystore


cacount:
cafiles:

intermediate:
  parentserver:
    url: https://ca-org1:7054
    caname: ca.org1.example.com

  enrollment:
    hosts: localhost
    profile:
    label:

  tls:
    certfiles:
    client:
      certfile:
      keyfile:

Answer 1

由于您将 CA 配置为 TLS 已启用，中间 CA 必须使用根 TLS 证书。检查您的中间 CA 文件的相应部分。

certfiles 属性的值 /tmp/root-ca-cert.pem 与根 CA 的文件相同：/tmp/hyperledger/fabric-ca/crypto/ca-cert.pem

intermediate:   
  parentserver:
    url: https://admin:admin@root.ca.example.com:7054
    caname: root.ca.example.com

  enrollment:
    hosts:
      - ca1.example.com
    profile: ca
    label:

  tls:
    certfiles:
      - /tmp/root-ca-cert.pem
    client:
      certfile:
      keyfile:

Hyperledger Fabric 面临难以设置中间 CA

Hyperledger fabric facing difficult setting up intermediate CA

x509certificate2

hyperledger

hyperledger-fabric