hyperledger-fabirc1.2-ca-server的生产示例


hyperledger-fabirc1.2-ca-server的生产示例,带TLS

在fabirc-samples/first-network中启动网络,其ca证书是利用crypto的工具生成的,但是在正式生产中,我们不能这样,可以借助fabric-ca-server ,fabric-ca-client .

本示例演示,一个orderer 三个peer,一个rootca,一个middleca,利用middleca 生成证书。

ca peer orderer
root.fp.com middle.fp.com peer0.org1.fp.com peer1.org1.fp.com peer2.org1.fp.com orderer.fp.com
  1. 新建fabric-fp-network文件夹下来咱们的东西都在该文件夹下进行
  2. 编写ca的docker文件docker-ca.yaml ,一个rootca,一个middleca,container名称

    完成之后,docker-compose -f docker-ca.yaml up -d 启动docker容器,完事之后docker ps -a 查看是否启动成功。

如果不在docker中启动ca,需要在本地启动执行:

  • export FABRIC_CA_HOME=fabric-fp-network/ca/middleCA
  • fabric-ca-server start -b admin:adminpw --cfg.affiliations.allowremove --cfg.identities.allowremove
  • export FABRIC_CA_HOME=fabric-fp-network/ca/middleCA
  • fabric-ca-server start -b admin:vsaCNbZGpOtR -u http://admin:adminpw@root.fp.com:7054 -p 7055 --cfg.affiliations.allowremove --cfg.identities.allowremove
    至此,ca-server已经启动起来
  1. 下来初始化caAdmin信息

    export FABRIC_CA_CLIENT_HOME=fabric-fp-network/fabric-ca-files/caAdmin

    fabric-ca-client enroll -d -u http://admin:vsaCNbZGpOtR@localhost:7055

  2. 添加org信息,首先查看其联盟结构默认是org1 org2,为了简化删除所有的org,只保留org1
    • fabric-ca-client affiliation list
    • fabric-ca-client affiliation remove --force org1
    • fabric-ca-client affiliation remove --force org2
    • fabric-ca-client affiliation add org1
  3. 下来进行orderer Register ,首先Register一个orderer信息
    我们可以修改fabric-fp-network/fabric-ca-files/caAdmin/fabric-ca-client-config.yaml中的id节点为下面信息

    id:
    name: orderer.fp.com
    type: orderer
    affiliation: org1
    maxenrollments: 0
    attributes:

    为了演示,我们所有的都一参数传递,后面也不在进行任何yaml文件修改。所以直接执行下面的即可

    fabric-ca-client register -d --id.secret orderer.fp.compw --id.name orderer.fp.com --id.type orderer --id.affiliation org1

    然后我们register admin信息

    fabric-ca-client register -d --id.secret Admin.fp.compw --id.name Admin@fp.com --id.type client --id.affiliation org1 --id.attrs admin=true:ecert

  4. 接下来我们需要获取orderer的msp信息

    fabric-ca-client getcacert -d -u http://localhost:7055 -M fabric-fp-network/fabric-ca-files/fp.com/msp --id.type client --id.affiliation org1

    完成之后我们,需要复制tls信息,进入到fabric-fp-network/fabric-ca-files/fp.com/msp下新建
    tlscacerts 、tlsintermediatecerts文件夹,将cacerts复制到tlscacerts,intermediatecerts复制到tlsintermediatecerts

  5. 下来开始enroll orderer的admin信息

    export FABRIC_CA_CLIENT_HOME=fabric-fp-network/fabric-ca-files/fp.com/admin
    fabric-ca-client enroll -d -u http://Admin@fp.com:Admin.fp.compw@localhost:7055 --id.affiliation org1

    完事之后我们需要复制admin信息
    • 新建文件夹:fabric-fp-network/fabric-ca-files/fp.com/msp/admincerts
    • 新建文件夹:fabric-fp-network/fabric-ca-files/fp.com/admin/msp/admincerts
    • 复制 fabric-fp-network/fabric-ca-files/fp.com/admin/msp下的signcerts文件夹下的证书上面新建的文件夹中
  6. enroll orderer的tls证书信息

    export FABRIC_CA_CLIENT_HOME=fabric-fp-network/fabric-ca-files/fp.com/orderer

    fabric-ca-client enroll -d --enrollment.profile tls -u http://orderer.fp.com:orderer.fp.compw@localhost:7055 -M fabric-fp-network/fabric-ca-files/fp.com/orderer/tls --csr.hosts orderer.fp.com --id.affiliation org1

    生成tls证书之后,复制证书信息

    • 复制 fabric-fp-network/fabric-ca-files/fp.com/orderer/tls/keystore/* 到fabric-fp-network/fabric-ca-files/fp.com/orderer/tls/server.key
    • 复制f abric-fp-network/fabric-ca-files/fp.com/orderer/tls/signcerts/* 到fabric-fp-network/fabric-ca-files/fp.com/orderer/tls/server.crt
    • 复制 fabric-fp-network/fabric-ca-files/ca/middleCA/ca-chain.pem 到fabric-fp-network/fabric-ca-files/fp.com/orderer/tls/ca.crt
  7. 下来enroll orderer信息

    fabric-ca-client enroll -d -u http://orderer.fp.com:orderer.fp.compw@localhost:7055 -M fabric-fp-network/fabric-ca-files/fp.com/orderer/msp --id.affiliation org1

    成功之后,我们需要复制tls信息
    • 新建fabric-fp-network/fabric-ca-files/fp.com/orderer/msp/tlscacerts
    • 新建fabric-fp-network/fabric-ca-files/fp.com/orderer/msp/tlsintermediatecerts
    • 复制 fabric-fp-network/fabric-ca-files/fp.com/orderer/msp/cacerts到fabric-fp-network/fabric-ca-files/fp.com/orderer/msp/tlscacerts
    • 复制 fabric-fp-network/fabric-ca-files/fp.com/orderer/msp/intermediatecerts到fabric-fp-network/fabric-ca-files/fp.com/orderer/msp/tlsintermediatecerts
  8. 下来我们以hyperledger/fabric-samples/first-network生成的crypto-config为例,将orderer信息与其对应起来:
  • fabric-ca-files/fp.com/admin 对应 crypto-config/ordererOrganizations/fp.com/users/Admin@fp.com
  • fabric-ca-files/fp.com/orderer 对应 crypto-config/ordererOrganizations/fp.com/orderers/orderer.fp.com
  • fabric-ca-files/fp.com/msp 对应 crypto-config/ordererOrganizations/fp.com/msp
    至此,orderer的所有信息生成完成。

peer的所有流程跟orderer一样,所以peer的流程在此不做演示了。
完整的逻辑 、docker文件等都已上传至github上,如果有不懂peer生成的可以去github查看

GitHub 地址:
hyperledger-fabric-ca生产示例
参考:
https://github.com/hyperledger/fabric-samples/tree/release-1.2/fabric-ca
ca-server的验证
fabric-ca的应用


作者:早就在城下,发布于:2018/11/09
原文:https://www.cnblogs.com/citydog/p/9934164.html