fabric-ca服务构建及证书生成

已于 2023-04-18 16:38:39 修改
阅读量3.6k 收藏 19
点赞数 2
分类专栏： Fabric 文章标签： 区块链 ca证书
于 2020-07-31 17:20:06 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/chenzhiang1/article/details/107712755
版权

前言：

1、为了保证在网络通信过程中信息的安全性，fabric可以设置tls网络通信模式，这就需要我们来生成相关的数字签名证书。关于tls通信需要数字证书的原因以及通信过程，见tls安全网络传输

2、之前fabric的相关证书是我们手动用cryptogen命令来生成的，但是在实际的应用场景中，如果新增用户，这种方式肯定是不行的，我们需要用fabric-ca的方式来生成相关证书。

一、fabric-ca服务的启动

1、fabric-ca镜像

         在这里，我们使用docker的方式来启动fabric-ca服务，在启动之前，我们需要下载相关的镜像。

         我们直接下载hyperledger/fabric-ca:latest镜像，如下图所示：

         docker pull hyperledger/fabric-ca:latest

2、docker-compose.yaml

         我们这里启动三个CA服务，分别作为Org1，Org2，Orderer的CA，三个CA服务相互独立。编写docker-compose.yaml文件

         docker-compose-orderer.yaml

fabric-ca-server-orderer:
  image: hyperledger/fabric-ca:latest
  container_name: fabric-ca-server-orderer
  ports:
    - "9054:9054"
  environment:
    - FABRIC_CA_HOME=/etc/hyperledger/fabric-ca-server
    - FABRIC_CA_SERVER_PORT=9054
    - FABRIC_CA_SERVER_CA_NAME=ca-orderer
    - COMPOSE_PROJECT_NAME=ca-orderer
  volumes:
    - "./fabric-ca-server-orderer:/etc/hyperledger/fabric-ca-server"
  command: sh -c 'fabric-ca-server start -b admin:adminpw'

         docker-compose-org1.yaml

fabric-ca-server-org1:
  image: hyperledger/fabric-ca:latest
  container_name: fabric-ca-server-org1
  ports:
    - "7054:7054"
  environment:
    - FABRIC_CA_HOME=/etc/hyperledger/fabric-ca-server
    - FABRIC_CA_SERVER_PORT=7054
    - FABRIC_CA_SERVER_CA_NAME=ca-org1
    - COMPOSE_PROJECT_NAME=ca-org1
  volumes:
    - "./fabric-ca-server-org1:/etc/hyperledger/fabric-ca-server"
  command: sh -c 'fabric-ca-server start -b admin:adminpw'

         docker-compose-org2.yaml

fabric-ca-server-org2:
  image: hyperledger/fabric-ca:latest
  container_name: fabric-ca-server-org2
  ports:
    - "8054:8054"
  environment:
    - FABRIC_CA_HOME=/etc/hyperledger/fabric-ca-server
    - FABRIC_CA_SERVER_PORT=8054
    - FABRIC_CA_SERVER_CA_NAME=ca-org2
    - COMPOSE_PROJECT_NAME=ca-org2
  volumes:
    - "./fabric-ca-server-org2:/etc/hyperledger/fabric-ca-server"
  command: sh -c 'fabric-ca-server start -b admin:adminpw'

3、启动容器

docker-compose -f docker-compose-orderer.yml up -d
docker-compose -f docker-compose-org1.yml up -d
docker-compose -f docker-compose-org2.yml up -d

fabric-ca启动成功之后，在当前文件夹下会生成fabric-ca-server-org1，fabric-ca-server-org2，fabric-ca-server-orderer三个文件夹，里面分别存放的是org1-CA，org2-CA，orderer-CA的根证书(ca-cert.pem)和私钥(ff6a43faf30fefb3ddd47033e34318b93d580513eebc2bf0ca464f07f4ca01f4_sk)，目录结构如下：

二、生成证书

1、编译fabric-ca-client

        为了生成证书，我们需要fabric-ca-client命令。 我这边是手动进行编译的，下载fabric-ca源码，使用master分支即可。

        (1)、注意事项：

        由于是第一次使用golang语言开发的项目，发现hyperleger-fabric这个项目必须放在一个固定的目录，该项目必须放在golang的src/github.com/hyperledger目录下，同理，fabric-ca这个项目也必须放在这个目录下，否则编译将报错找不到相关的代码。

如下，我的golang的安装目录是：/home/zachen2/golang/go

           在golang的目录下有一个src目录，我们必须手动创建目录：src/github.com/hyperledger

           然后将fabric-ca的源码下载到src/github.com/hyperledger这个目录下，如下图所示：

          

       (2)、编译

       进入到fabric-ca目录，直接使用make fabric-ca-client命令进行编译。

      编译完成后，会在fabric-ca的bin目录下生成fabric-ca-client命令，如下图所示：

      

2、证书生成

  • 作者的fabric网络节点架构如下：

        组织1：一个peer节点，一个Admin，一个User

        组织2：一个peer节点，一个Admin，一个User

        orderer：三个orderer节点，一个Admin

  • 生成证书的命令如下：
  • #!/bin/bash

export FABRIC_CA_CLIENT_HOME=${PWD}/organizations/peerOrganizations/org1.example.com/

./fabric-ca-client enroll -u http://admin:adminpw@localhost:7054 --caname ca-org1

echo 'NodeOUs:
  Enable: true
  ClientOUIdentifier:
    Certificate: cacerts/localhost-7054-ca-org1.pem
    OrganizationalUnitIdentifier: client
  PeerOUIdentifier:
    Certificate: cacerts/localhost-7054-ca-org1.pem
    OrganizationalUnitIdentifier: peer
  AdminOUIdentifier:
    Certificate: cacerts/localhost-7054-ca-org1.pem
    OrganizationalUnitIdentifier: admin
  OrdererOUIdentifier:
    Certificate: cacerts/localhost-7054-ca-org1.pem
    OrganizationalUnitIdentifier: orderer' > ${PWD}/organizations/peerOrganizations/org1.example.com/msp/config.yaml

#组织1 peer0的msp证书
./fabric-ca-client register --caname ca-org1 --id.name peer0 --id.secret peer0pw --id.type peer --id.attrs '"hf.Registrar.Roles=peer"'

./fabric-ca-client enroll -u http://peer0:peer0pw@localhost:7054 --caname ca-org1 -M ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/msp --csr.hosts aa,peer0.org1.example.com

cp ${PWD}/organizations/peerOrganizations/org1.example.com/msp/config.yaml ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/msp

./fabric-ca-client enroll -u http://peer0:peer0pw@localhost:7054 --caname ca-org1 -M ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls --enrollment.profile tls --csr.hosts aa,peer0.org1.example.com

cp ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/tlscacerts/* ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt
cp ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/signcerts/* ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/server.crt
cp ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/keystore/* ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/server.key

mkdir ${PWD}/organizations/peerOrganizations/org1.example.com/msp/tlscacerts
cp ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/tlscacerts/* ${PWD}/organizations/peerOrganizations/org1.example.com/msp/tlscacerts/ca.crt

mkdir ${PWD}/organizations/peerOrganizations/org1.example.com/tlsca
cp ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/tlscacerts/* ${PWD}/organizations/peerOrganizations/org1.example.com/tlsca/tlsca.org1.example.com-cert.pem

mkdir ${PWD}/organizations/peerOrganizations/org1.example.com/ca
cp ${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/msp/cacerts/* ${PWD}/organizations/peerOrganizations/org1.example.com/ca/ca.org1.example.com-cert.pem

#组织1 user的证书
./fabric-ca-client register --caname ca-org1 --id.name user1 --id.secret user1pw --id.type client --id.attrs '"hf.Registrar.Roles=client"'

./fabric-ca-client enroll -u http://user1:user1pw@localhost:7054 --caname ca-org1 -M ${PWD}/organizations/peerOrganizations/org1.example.com/users/User1@org1.example.com/msp  

./fabric-ca-client enroll -u http://user1:user1pw@localhost:7054 --caname ca-org1 -M ${PWD}/organizations/peerOrganizations/org1.example.com/users/User1@org1.example.com/tls  --enrollment.profile tls

cp ${PWD}/organizations/peerOrganizations/org1.example.com/users/User1@org1.example.com/tls/tlscacerts/* ${PWD}/organizations/peerOrganizations/org1.example.com/users/User1@org1.example.com/tls/ca.crt
cp ${PWD}/organizations/peerOrganizations/org1.example.com/users/User1@org1.example.com/tls/signcerts/* ${PWD}/organizations/peerOrganizations/org1.example.com/users/User1@org1.example.com/tls/client.crt
cp ${PWD}/organizations/peerOrganizations/org1.example.com/users/User1@org1.example.com/tls/keystore/* ${PWD}/organizations/peerOrganizations/org1.example.com/users/User1@org1.example.com/tls/client.key

cp ${PWD}/organizations/peerOrganizations/org1.example.com/msp/config.yaml ${PWD}/organizations/peerOrganizations/org1.example.com/users/User1@org1.example.com/msp/config.yaml

#组织1 admin的证书
./fabric-ca-client register --caname ca-org1 --id.name org1admin --id.secret org1adminpw --id.type admin --id.attrs '"hf.Registrar.Roles=admin"'

./fabric-ca-client enroll -u http://org1admin:org1adminpw@localhost:7054 --caname ca-org1 -M ${PWD}/organizations/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp 

./fabric-ca-client enroll -u http://org1admin:org1adminpw@localhost:7054 --caname ca-org1 -M ${PWD}/organizations/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls  --enrollment.profile tls 

cp ${PWD}/organizations/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/tlscacerts/* ${PWD}/organizations/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/ca.crt
cp ${PWD}/organizations/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/signcerts/* ${PWD}/organizations/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/client.crt
cp ${PWD}/organizations/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/keystore/* ${PWD}/organizations/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/client.key

cp ${PWD}/organizations/peerOrganizations/org1.example.com/msp/config.yaml ${PWD}/organizations/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp/config.yaml

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

export FABRIC_CA_CLIENT_HOME=${PWD}/organizations/peerOrganizations/org2.example.com/

./fabric-ca-client enroll -u http://admin:adminpw@localhost:8054 --caname ca-org2

echo 'NodeOUs:
  Enable: true
  ClientOUIdentifier:
    Certificate: cacerts/localhost-8054-ca-org2.pem
    OrganizationalUnitIdentifier: client
  PeerOUIdentifier:
    Certificate: cacerts/localhost-8054-ca-org2.pem
    OrganizationalUnitIdentifier: peer
  AdminOUIdentifier:
    Certificate: cacerts/localhost-8054-ca-org2.pem
    OrganizationalUnitIdentifier: admin
  OrdererOUIdentifier:
    Certificate: cacerts/localhost-8054-ca-org2.pem
    OrganizationalUnitIdentifier: orderer' > ${PWD}/organizations/peerOrganizations/org2.example.com/msp/config.yaml

#组织2 peer0的msp证书
./fabric-ca-client register --caname ca-org2 --id.name peer0 --id.secret peer0pw --id.type peer --id.attrs '"hf.Registrar.Roles=peer"'

./fabric-ca-client enroll -u http://peer0:peer0pw@localhost:8054 --caname ca-org2 -M ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/msp --csr.hosts aa,peer0.org2.example.com

cp ${PWD}/organizations/peerOrganizations/org2.example.com/msp/config.yaml ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/msp

./fabric-ca-client enroll -u http://peer0:peer0pw@localhost:8054 --caname ca-org2 -M ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls --enrollment.profile tls --csr.hosts aa,peer0.org2.example.com

cp ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/tlscacerts/* ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt
cp ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/signcerts/* ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/server.crt
cp ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/keystore/* ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/server.key

mkdir ${PWD}/organizations/peerOrganizations/org2.example.com/msp/tlscacerts
cp ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/tlscacerts/* ${PWD}/organizations/peerOrganizations/org2.example.com/msp/tlscacerts/ca.crt

mkdir ${PWD}/organizations/peerOrganizations/org2.example.com/tlsca
cp ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/tlscacerts/* ${PWD}/organizations/peerOrganizations/org2.example.com/tlsca/tlsca.org2.example.com-cert.pem

mkdir ${PWD}/organizations/peerOrganizations/org2.example.com/ca
cp ${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/msp/cacerts/* ${PWD}/organizations/peerOrganizations/org2.example.com/ca/ca.org2.example.com-cert.pem

#组织2 user的证书
./fabric-ca-client register --caname ca-org2 --id.name user1 --id.secret user1pw --id.type client --id.attrs '"hf.Registrar.Roles=client"'

./fabric-ca-client enroll -u http://user1:user1pw@localhost:8054 --caname ca-org2 -M ${PWD}/organizations/peerOrganizations/org2.example.com/users/User1@org2.example.com/msp 

./fabric-ca-client enroll -u http://user1:user1pw@localhost:8054 --caname ca-org2 -M ${PWD}/organizations/peerOrganizations/org2.example.com/users/User1@org2.example.com/tls  --enrollment.profile tls 

cp ${PWD}/organizations/peerOrganizations/org2.example.com/users/User1@org2.example.com/tls/tlscacerts/* ${PWD}/organizations/peerOrganizations/org2.example.com/users/User1@org2.example.com/tls/ca.crt
cp ${PWD}/organizations/peerOrganizations/org2.example.com/users/User1@org2.example.com/tls/signcerts/* ${PWD}/organizations/peerOrganizations/org2.example.com/users/User1@org2.example.com/tls/client.crt
cp ${PWD}/organizations/peerOrganizations/org2.example.com/users/User1@org2.example.com/tls/keystore/* ${PWD}/organizations/peerOrganizations/org2.example.com/users/User1@org2.example.com/tls/client.key

cp ${PWD}/organizations/peerOrganizations/org2.example.com/msp/config.yaml ${PWD}/organizations/peerOrganizations/org2.example.com/users/User1@org2.example.com/msp/config.yaml

#组织2 admin的证书
./fabric-ca-client register --caname ca-org2 --id.name org1admin --id.secret org1adminpw --id.type admin --id.attrs '"hf.Registrar.Roles=admin"'

./fabric-ca-client enroll -u http://org1admin:org1adminpw@localhost:8054 --caname ca-org2 -M ${PWD}/organizations/peerOrganizations/org2.example.com/users/Admin@org2.example.com/msp 

./fabric-ca-client enroll -u http://org1admin:org1adminpw@localhost:8054 --caname ca-org2 -M ${PWD}/organizations/peerOrganizations/org2.example.com/users/Admin@org2.example.com/tls  --enrollment.profile tls 

cp ${PWD}/organizations/peerOrganizations/org2.example.com/users/Admin@org2.example.com/tls/tlscacerts/* ${PWD}/organizations/peerOrganizations/org2.example.com/users/Admin@org2.example.com/tls/ca.crt
cp ${PWD}/organizations/peerOrganizations/org2.example.com/users/Admin@org2.example.com/tls/signcerts/* ${PWD}/organizations/peerOrganizations/org2.example.com/users/Admin@org2.example.com/tls/client.crt
cp ${PWD}/organizations/peerOrganizations/org2.example.com/users/Admin@org2.example.com/tls/keystore/* ${PWD}/organizations/peerOrganizations/org2.example.com/users/Admin@org2.example.com/tls/client.key

cp ${PWD}/organizations/peerOrganizations/org2.example.com/msp/config.yaml ${PWD}/organizations/peerOrganizations/org2.example.com/users/Admin@org2.example.com/msp/config.yaml

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

export FABRIC_CA_CLIENT_HOME=${PWD}/organizations/ordererOrganizations/example.com

./fabric-ca-client enroll -u http://admin:adminpw@localhost:9054 --caname ca-orderer

echo 'NodeOUs:
  Enable: true
  ClientOUIdentifier:
    Certificate: cacerts/localhost-9054-ca-orderer.pem
    OrganizationalUnitIdentifier: client
  PeerOUIdentifier:
    Certificate: cacerts/localhost-9054-ca-orderer.pem
    OrganizationalUnitIdentifier: peer
  AdminOUIdentifier:
    Certificate: cacerts/localhost-9054-ca-orderer.pem
    OrganizationalUnitIdentifier: admin
  OrdererOUIdentifier:
    Certificate: cacerts/localhost-9054-ca-orderer.pem
    OrganizationalUnitIdentifier: orderer' > ${PWD}/organizations/ordererOrganizations/example.com/msp/config.yaml
#orderer的证书
./fabric-ca-client register --caname ca-orderer --id.name orderer --id.secret ordererpw --id.type orderer --id.attrs '"hf.Registrar.Roles=orderer"'

./fabric-ca-client enroll -u http://orderer:ordererpw@localhost:9054 --caname ca-orderer -M ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp --csr.hosts aa,orderer.example.com

cp ${PWD}/organizations/ordererOrganizations/example.com/msp/config.yaml ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/config.yaml

./fabric-ca-client enroll -u http://orderer:ordererpw@localhost:9054 --caname ca-orderer -M ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls --enrollment.profile tls --csr.hosts aa,orderer.example.com

cp ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls/tlscacerts/* ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls/ca.crt
cp ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls/signcerts/* ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls/server.crt
cp ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls/keystore/* ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls/server.key

mkdir ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts
cp ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls/tlscacerts/* ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem

mkdir ${PWD}/organizations/ordererOrganizations/example.com/msp/tlscacerts
cp ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls/tlscacerts/* ${PWD}/organizations/ordererOrganizations/example.com/msp/tlscacerts/ca.crt



#orderer2的证书
./fabric-ca-client register --caname ca-orderer --id.name orderer2 --id.secret orderer2pw --id.type orderer --id.attrs '"hf.Registrar.Roles=orderer"'

./fabric-ca-client enroll -u http://orderer2:orderer2pw@localhost:9054 --caname ca-orderer -M ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer2.example.com/msp --csr.hosts aa,orderer2.example.com

cp ${PWD}/organizations/ordererOrganizations/example.com/msp/config.yaml ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer2.example.com/msp/config.yaml

./fabric-ca-client enroll -u http://orderer2:orderer2pw@localhost:9054 --caname ca-orderer -M ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer2.example.com/tls --enrollment.profile tls --csr.hosts aa,orderer2.example.com

cp ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer2.example.com/tls/tlscacerts/* ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer2.example.com/tls/ca.crt
cp ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer2.example.com/tls/signcerts/* ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer2.example.com/tls/server.crt
cp ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer2.example.com/tls/keystore/* ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer2.example.com/tls/server.key

mkdir ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer2.example.com/msp/tlscacerts
cp ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer2.example.com/tls/tlscacerts/* ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer2.example.com/msp/tlscacerts/tlsca.example.com-cert.pem


#orderer3的证书
./fabric-ca-client register --caname ca-orderer --id.name orderer3 --id.secret orderer3pw --id.type orderer --id.attrs '"hf.Registrar.Roles=orderer"'

./fabric-ca-client enroll -u http://orderer3:orderer3pw@localhost:9054 --caname ca-orderer -M ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer3.example.com/msp --csr.hosts aa,orderer3.example.com 

cp ${PWD}/organizations/ordererOrganizations/example.com/msp/config.yaml ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer3.example.com/msp/config.yaml

./fabric-ca-client enroll -u http://orderer3:orderer3pw@localhost:9054 --caname ca-orderer -M ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer3.example.com/tls --enrollment.profile tls --csr.hosts aa,orderer3.example.com 

cp ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer3.example.com/tls/tlscacerts/* ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer3.example.com/tls/ca.crt
cp ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer3.example.com/tls/signcerts/* ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer3.example.com/tls/server.crt
cp ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer3.example.com/tls/keystore/* ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer3.example.com/tls/server.key

mkdir ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer3.example.com/msp/tlscacerts
cp ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer3.example.com/tls/tlscacerts/* ${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer3.example.com/msp/tlscacerts/tlsca.example.com-cert.pem


#orderer admin的证书
./fabric-ca-client register --caname ca-orderer --id.name ordererAdmin --id.secret ordererAdminpw --id.type admin --id.attrs '"hf.Registrar.Roles=admin"'

./fabric-ca-client enroll -u http://ordererAdmin:ordererAdminpw@localhost:9054 --caname ca-orderer -M ${PWD}/organizations/ordererOrganizations/example.com/users/Admin@example.com/msp 

cp ${PWD}/organizations/ordererOrganizations/example.com/msp/config.yaml ${PWD}/organizations/ordererOrganizations/example.com/users/Admin@example.com/msp/config.yaml

./fabric-ca-client enroll -u http://ordererAdmin:ordererAdminpw@localhost:9054 --caname ca-orderer -M ${PWD}/organizations/ordererOrganizations/example.com/users/Admin@example.com/tls --enrollment.profile tls 

cp ${PWD}/organizations/ordererOrganizations/example.com/users/Admin@example.com/tls/tlscacerts/* ${PWD}/organizations/ordererOrganizations/example.com/users/Admin@example.com/tls/ca.crt

cp ${PWD}/organizations/ordererOrganizations/example.com/users/Admin@example.com/tls/signcerts/* ${PWD}/organizations/ordererOrganizations/example.com/users/Admin@example.com/tls/client.crt

cp ${PWD}/organizations/ordererOrganizations/example.com/users/Admin@example.com/tls/keystore/* ${PWD}/organizations/ordererOrganizations/example.com/users/Admin@example.com/tls/client.key

3、遇到的问题

        (1)、关于--csr.hosts参数的问题

                这个参数，我在网上查了一下，会生成到证书的X509v3 Subject Alternative Name中去，这个Subject Alternative Name的作用是说明了这张证书支持的域名，一个数字证书可以支持多个域名。

                在上面生成证书命令中，我把--csr.hosts的第一个域名都设置成了aa，原因是：

                1、如果我设置一个对应的域名(比如orderer.example.com)，这个域名会被我电脑的主机名给覆盖掉(暂时不知道原因)，导致Subject Alternative Name中的域名不正确。

                2、如果我把--csr.hosts设置成aa,orderer.example.com，那么他只会覆盖第一个域名aa，后面的域名orderer.example.com会正确保留下来，如下图：

反解证书的命令：openssl x509 --in server.crt -text

 图中红框里的就是Subject Alternative Name，可以看到并没有aa这个域名，是被zachen2-VirtualBox(我utuntu机器的主机名)给覆盖掉了。

 所以为了避免这个问题，我给所有的--csr.hosts的都加了一个aa的域名，防止我想要的域名给覆盖掉。

 (2)、上面生成证书的命令中，有很多是cp数据拷贝的命令，这些是必不可少的，不能省略。尤其是config.yaml文件的生成和拷贝过程是不可缺少的，不然在后面生成genesis.block的过程中会报错。

冰雪_ang
关注
  • 2
    点赞
  • 踩
  • 19
    收藏
    觉得还不错? 一键收藏
  • 3
    评论
专栏目录
自定义Fabric 1.0 Crypto工具生成CA文件
h363659487的博客
10-27 1497
自定义Fabric 1.0 Crypto工具生成CA文件
Fabric CA官方文档翻译——CA Deployment steps
ling的专栏
10-10 526
翻译https://hyperledger-fabric-ca.readthedocs.io/en/latest/deployguide/cadeploy.html 下载可执行文件 FabricCAserver和CAclient执行文件可以从github.下载最新版。.zip文件包含了CAserver和client。在你通过使用执行文件掌握了CA的部署和运行后，你可能很希望使用FabricCA的docker镜像，例如在Kubernetes或Docker部署中。不过本文介绍如何正确使用二进...
1.Fabric-CA简介
boss2967的博客
10-12 1918
1.Fabric-CA简介 Fabric 设计中考虑了三种类型的证书：登记证书（Enrollment Certificate）、交易证书（Transaction Certificate），以及保障通信链路安全的 TLS 证书。证书的默认签名算法为 ECDSA，Hash 算法为 SHA-256。 登记证书（ECert）：颁发给提供了注册凭证的用户或节点等实体，代表网络中身份。一般长期有效。 交易证书（TCert）：颁发给用户，控制每个交易的权限，不同交易可以不同，实现匿名性。短期有效。 通信证书（TLS..
超级账本学习笔记（8）-fabric-ca
最新发布
weixin_48473914的博客
04-19 793
用Fabric CA生成的证书替换第8章 Fabric Kafka生产环境部署中使用cryptogen生成的证书，复制./fabric-ca-client/crypto-config目录到kafkapeer目录下（删除原先的crypto-config目录），然后生成创世区块和通道配置文件，后续步骤将下面的代码。在 Fabric-CA 客户端主目录下创建配置文件 fabric-ca-clien-config.yaml 和 msp 子目录，存储注册证书（ECert），相应的私钥和 CA 证书 PEM 文件。
2021-04-15-fabric-ca详解
Soulmate的博客
07-16 2958
title: fabric-ca详解 date: 2021-04-15 14:30:23 categories: Hyperledger Fabric tags: Hyperledger Fabric fabric-ca MSP msp定义 msp是hyperleger fabric对网络中的组成成员进行身份管理与验证的模块组件。 作用： 管理用户ID 验证想要加入网络的节点 为客户发起的交易提供凭证 网络MSP：对整个hyperledger fabric网络中的成员进行管理；定义参与组织的MSP.
Fabric-CA-Client常用命令及注册新账户步骤
Mark的博客
02-23 5798
一、常用命令及例子 fabric-ca-client主要子命令 fabric-ca-client用来管理身份（包括属性管理）和证书（包括续订和回收）。主要子命令如下： affiliation：管理分支机构 certificate：管理证书 enroll：认证一个账号 gencrl：撤销证书？（生成一个CRL） gencsr：创建证书签名（生成一个CSR：Certificate Signing R...
fabric2.2 tls和签名认证证书过期解决方案
心若留念的博客
02-21 1750
1. fabric证书过期替换 1.1 记录需要修改目录 ## 记录需要修改目录 fabric-ca/ordererOrg/tls-cert.pem fabric-ca/org1/tls-cert.pem fabric-ca/org1/tls-cert.pem organizations/ordererOrganizations/example.com/msp/signcerts/cert.pem organizations/ordererOrganizations/example.com/msp/k
利用fabric-ca生成区块链证书
10-25
本教程将详细介绍如何利用Fabric CA服务生成区块链证书，涵盖纯命令行操作以及编写脚本的方式。 首先，Fabric CA是Hyperledger Fabric的身份管理系统，它负责注册和认证网络中的参与者，如节点、用户和组织。证书是...
hyperledger-fabric-ca-linux-amd64-1.5.2.tar.gz
03-29
1. **Hyperledger Fabric CA**：Hyperledger Fabric CA是用于身份管理和证书生命周期管理的服务。它负责为参与网络的组织、节点和用户生成、注册、激活和撤销数字证书。CA服务是区块链网络中安全性的基石，因为它...
hyperledger-fabric-ca-linux-amd64-1.4.6.tar.gz
08-19
3. **fabric-ca-init**：初始化Fabric CA服务器的命令，用于生成服务器的配置文件和密钥材料。这一步是启动CA服务器前的必要步骤。 4. **fabric-ca-listen**：列出已注册的实体，包括用户、组织和节点，方便进行...
hyperledger-fabric-ca-linux-amd64-1.4.4.tar.gz
04-05
这个CA服务器通过生成和管理X.509证书，确保了参与者的身份验证和交易的加密。1.4.4版本是Hyperledger Fabric CA的一个稳定版本，提供了许多增强功能和优化，以提高性能和安全性。 二、主要特性 1. **注册与身份...
hyperledger-fabric-ca-linux-amd64-2.0.1.zip
04-06
hyperledger-fabric-ca-linux-amd64-2.0.1
fabric-ca-client
03-25
fabric-client,快速下载 hyperledger-fabric-ca-linux-amd64-1.4.4
fabric-ca 二进制文件
04-17
Fabric 的一个重要组成部分就是 fabric-ca，即 Fabric 身份认证服务（Fabric Certificate Authority），它是负责管理网络中各个参与者的身份证书的服务。本篇文章将深入探讨 fabric-ca 的二进制文件，特别是 `hyper...
【Hyperledger Fabric入门】(二) Fabric账号服务器：Fabric-ca
Famidlistimo的博客
03-28 1201
目录一、Fabric-ca的编译和安装二、 Fabric-ca-server的启动和配置1. Fabric-ca-server命令行选项2. Fabric-ca-server的选项3. Fabric-ca-server初始化4. Fabric-ca-server启动三、 Fabric-ca-client的使用1. Fabric-ca-client模块子命令2. Fabric-ca-client模块参数选项四、将fabric-ca-server集成到现有项目中1. 绑定fabric-ca-server到现有
Hyperledger Fabric手动生成CA证书搭建Fabric网络
li123128的博客
12-08 1278
　　之前介绍了使用官方脚本自动化启动一个Fabric网络，并且所有的证书都是通过官方的命令行工具cryptogen直接生成网络中的所有节点的证书。在开发环境可以这么简单进行，但是生成环境下还是需要我们自定义对网络中的节点的证书进行配置。 　　 　　所以在本文中，将会详细介绍一个从手动生成证书一直到启动网络的整体步骤。本文只交代整体的搭建步骤。对于Fabric-Ca的讲解不在本文的范围内，将在另一篇...
fabric中cryptogen模块基于配置文件生成证书
srk9515的博客
09-14 136
我们生成cryptogen后，在workplace/src中创建一个新的文件夹hyperledger。再通过cryptogen中showtemplate命令找到证书模板，将证书写入conf.yaml:再修改yaml：1.orderorgs：order节点2.name：组织名称3.domain：根域名4.-Hostname:二级域名5.peerorgs：peer节点6..count：生成peer节点的数量（从peer0开始）根据自己需求选择即可。
Fabric CA
qq_22016915的博客
08-29 2458
参考 1.fabric-ca安装 2.Fabric-CA 架构及安装 3.Fabric-Ca使用 4.Fabric CA的部署与使用 5.HyperLedger Fabric中Fabric-CA的使用 6.Fabric CA源码和镜像编译 sudo gedit /etc/profile 7.Fabric-CA 架构及安装 8.Fabric CA的部署与使用 【GO】详解GOROOT和GOPATH go语言的工作空间和GOPATH环境变量 待学习 Go Modules 终极入门 HyperLedger Fab

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 3
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值