Fabric CA 学习记录_区块链

Fabric CA 学习记录什么是Fabric CA生产环境建议安装1. 依赖条件设置TLS CA1.启动TLS CA 容器1. 目录结构 2.注册 TLS CA 的管理员设置订购组织的CA 管理1. 启动容器2.注册订购者组织的 CA 管理员设置 Org1 的 CA1.启动容器2.注册 Org1 的 CA 管理员设置 org2 的CA1.启动容器注册org2的管理员注册org1 的节点peer11. 获取org1 的CA证书2. 注册peer13. 获取peer1 的TLS 加密并注册注册org1 的节点peer21. 获取org1 的CA证书2. 注册peer23. 获取peer2的TLS 加密并注册注册org1的管理员1.注册2. 将org1/admin/msp下的证书cp 到peer节点中3.启动org1的peer1、peer24.查看peer节点状态注册org2 的节点peer11. 获取org2的CA证书2.注册peer13. 获取peer1 的TLS 加密并注册注册org2的节点peer21. 获取org2的CA证书2.注册peer23. 获取peer2 的TLS 加密并注册注册org2的管理员1.注册2. 将org2/admin/msp下的证书cp 到peer节点中3.启动org2的peer1、peer2查看peer节点状态设置排序服务1.注册orderer2. TLS CA3.注册 Org0 的管理员
加入Fabric联盟链的计算机结点和用户都必须要经过注册并获得CA颁发的证书，才能在联盟链中 *** 作。证书颁发机构可以提供的功能如下：

身份的注册或连接到LDAP（Lightweight Directory Access Protocol，轻量目录访问协议）作为用户注册表;
签发登记证书（ECerts）（Enrollment Certificates）
签发交易证书（TCerts）（Transaction Certificates），在Hyperledger Fabric blockchain上交易时提供匿名性和不可链接性。
证书续期和撤销

与 Hyperledger Fabric CA 服务器交互的方式有两种：通过 Hyperledger Fabric CA 客户端或通过其中一个 Fabric SDK。与 Hyperledger Fabric CA 服务器的所有通信都是通过 REST API 进行的。

集群中的所有 Hyperledger Fabric CA 服务器共享同一个数据库以跟踪身份和证书。如果配置了 LDAP，身份信息将保存在 LDAP 而不是数据库中。

一个服务器可能包含多个 CA。每个 CA 要么是根 CA，要么是中间 CA。每个中间 CA 都有一个父 CA，它要么是根 CA，要么是另一个中间 CA。

什么是Fabric CA

Hyperledger Fabric CA 是 Hyperledger Fabric 的证书颁发机构 (CA)。
它提供以下功能：

身份注册，或作为用户注册表连接到 LDAP颁发注册证书 (ECerts)证书更新和撤销

Fabric CA 由服务器和客户端组件组成

生产环境建议

建议为每个组织部署两个 CA，一个组织 CA 和一个 TLS CA

TLS CA：
用来保护组织中节点之间的通信,生成所有节点的通信证书组织CA：
用于生成组织和节点身份

排序服务节点不应该与peer所属同一组织，因此需要为peer所在组织和排序服务节点单独创建组织

部署CA 服务时应遵循部署顺序为：
1）TLS CA
2）组织 CA

安装 1. 依赖条件

###依赖及go环境
yum install libtool libltdl-dev go  docker
###另需要
docker-compose

设置TLS CA

TLS CA 用于颁发 TLS 证书。需要这些证书来保护各种进程之间的通信。

1.启动TLS CA 容器

ca-tls:
  container_name: ca-tls
  image: hyperledger/fabric-ca
  command: sh -c 'fabric-ca-server start -d -b tls-ca-admin:tls-ca-adminpw --port 7052'
  environment:
    - FABRIC_CA_SERVER_HOME=/tmp/hyperledger/fabric-ca/crypto
    - FABRIC_CA_SERVER_TLS_ENABLED=true
    - FABRIC_CA_SERVER_CSR_CN=ca-tls
    - FABRIC_CA_SERVER_CSR_HOSTS=0.0.0.0
    - FABRIC_CA_SERVER_DEBUG=true
  volumes:
    - /tmp/hyperledger/tls/ca:/tmp/hyperledger/fabric-ca
  ports:
    - 7052:7052

docker-compose up -d ca-tls

1. 目录结构

[root@10 hyperledger]# tree
.
└── tls
    └── ca
        └── crypto
            ├── ca-cert.pem        ####TLS CA 的签名证书
            ├── fabric-ca-server-config.yaml
            ├── fabric-ca-server.db
            ├── IssuerPublicKey
            ├── IssuerRevocationPublicKey
            ├── msp
            │   ├── cacerts
            │   ├── keystore
            │   │   ├── 34f702f5508b0f890fb1996f12b91e3f537983b2b1a04cdc592a897d63653f53_sk
            │   │   ├── 5d3c6784f5d5d0df8f368e6cda6c483f5ebe8b7189fa8817c3543b487b654bdf_sk
            │   │   ├── IssuerRevocationPrivateKey
            │   │   └── IssuerSecretKey
            │   ├── signcerts
            │   └── user
            └── tls-cert.pem

2.注册 TLS CA 的管理员

TLS CA 的受信任根证书已复制到/tmp/hyperledger/tls-ca/crypto/tls-ca-cert.pem

cp /tmp/hyperledger/tls-ca/crypto/tls-cert.pem /tmp/hyperledger/tls-ca/crypto/tls-ca-cert.pem

export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/tls-ca/crypto/tls-cert.pem
export FABRIC_CA_CLIENT_HOME=/tmp/hyperledger/tls-ca/admin

fabric-ca-client enroll -d -u https://tls-ca-admin:tls-ca-adminpw@0.0.0.0:7052

注册节点
fabric-ca-client register -d --id.name peer1-org1 --id.secret peer1PW --id.type peer -u https://0.0.0.0:7052
fabric-ca-client register -d --id.name peer2-org1 --id.secret peer2PW --id.type peer -u https://0.0.0.0:7052
fabric-ca-client register -d --id.name peer1-org2 --id.secret peer1PW --id.type peer -u https://0.0.0.0:7052
fabric-ca-client register -d --id.name peer2-org2 --id.secret peer2PW --id.type peer -u https://0.0.0.0:7052
fabric-ca-client register -d --id.name orderer1-org0 --id.secret ordererPW --id.type orderer -u https://0.0.0.0:7052

设置订购组织的CA 管理 1. 启动容器

rca-org0:
   container_name: rca-org0
   image: hyperledger/fabric-ca
   command: /bin/bash -c 'fabric-ca-server start -d -b rca-org0-admin:rca-org0-adminpw --port 7053'
   environment:
      - FABRIC_CA_SERVER_HOME=/tmp/hyperledger/fabric-ca/crypto
      - FABRIC_CA_SERVER_TLS_ENABLED=true
      - FABRIC_CA_SERVER_CSR_CN=rca-org0
      - FABRIC_CA_SERVER_CSR_HOSTS=0.0.0.0
      - FABRIC_CA_SERVER_DEBUG=true
   volumes:
      - /tmp/hyperledger/org0/ca:/tmp/hyperledger/fabric-ca
   networks:
      - fabric-ca
   ports:
      - 7053:7053

docker-compose up -d rca-org0

2.注册订购者组织的 CA 管理员

export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/org0/ca/crypto/ca-cert.pem
export FABRIC_CA_CLIENT_HOME=/tmp/hyperledger/org0/ca/admin
fabric-ca-client enroll -d -u https://rca-org0-admin:rca-org0-adminpw@0.0.0.0:7053
fabric-ca-client register -d --id.name orderer1-org0 --id.secret ordererpw --id.type orderer -u https://0.0.0.0:7053
fabric-ca-client register -d --id.name admin-org0 --id.secret org0adminpw --id.type admin --id.attrs "hf.Registrar.Roles=client,hf.Registrar.Attributes=*,hf.Revoker=true,hf.GenCRL=true,admin=true:ecert,abac.init=true:ecert" -u https://0.0.0.0:7053

设置 Org1 的 CA 1.启动容器

rca-org1:
   container_name: rca-org1
   image: hyperledger/fabric-ca
   command: /bin/bash -c 'fabric-ca-server start -d -b rca-org1-admin:rca-org1-adminpw'
   environment:
      - FABRIC_CA_SERVER_HOME=/tmp/hyperledger/fabric-ca/crypto
      - FABRIC_CA_SERVER_TLS_ENABLED=true
      - FABRIC_CA_SERVER_CSR_CN=rca-org1
      - FABRIC_CA_SERVER_CSR_HOSTS=0.0.0.0
      - FABRIC_CA_SERVER_DEBUG=true
   volumes:
      - /tmp/hyperledger/org1/ca:/tmp/hyperledger/fabric-ca
   networks:
      - fabric-ca
   ports:
      - 7055:7054

docker-compose up -d rca-org1

2.注册 Org1 的 CA 管理员

Peer 1 (peer1-org1)
Peer 2 (peer2-org1)
Admin (admin1-org1)
End user (user-org1)

export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/org1/ca/crypto/ca-cert.pem
export FABRIC_CA_CLIENT_HOME=/tmp/hyperledger/org1/ca/admin
fabric-ca-client enroll -d -u https://rca-org1-admin:rca-org1-adminpw@0.0.0.0:7054
fabric-ca-client register -d --id.name peer1-org1 --id.secret peer1PW --id.type peer -u https://0.0.0.0:7054
fabric-ca-client register -d --id.name peer2-org1 --id.secret peer2PW --id.type peer -u https://0.0.0.0:7054
fabric-ca-client register -d --id.name admin-org1 --id.secret org1AdminPW --id.type user -u https://0.0.0.0:7054
fabric-ca-client register -d --id.name user-org1 --id.secret org1UserPW --id.type user -u https://0.0.0.0:7054

设置 org2 的CA 1.启动容器

rca-org2:
  container_name: rca-org2
  image: hyperledger/fabric-ca
  command: /bin/bash -c 'fabric-ca-server start -d -b rca-org2-admin:rca-org2-adminpw --port 7055'
  environment:
    - FABRIC_CA_SERVER_HOME=/tmp/hyperledger/fabric-ca/crypto
    - FABRIC_CA_SERVER_TLS_ENABLED=true
    - FABRIC_CA_SERVER_CSR_CN=rca-org2
    - FABRIC_CA_SERVER_CSR_HOSTS=0.0.0.0
    - FABRIC_CA_SERVER_DEBUG=true
  volumes:
    - /tmp/hyperledger/org2/ca:/tmp/hyperledger/fabric-ca
  networks:
    - fabric-ca
  ports:
    - 7055:7055

docker-compose up -d rca-org2

注册org2的管理员

export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/org2/ca/crypto/ca-cert.pem
export FABRIC_CA_CLIENT_HOME=/tmp/hyperledger/org2/ca/admin
fabric-ca-client enroll -d -u https://rca-org2-admin:rca-org2-adminpw@0.0.0.0:7055
fabric-ca-client register -d --id.name peer1-org2 --id.secret peer1PW --id.type peer -u https://0.0.0.0:7055
fabric-ca-client register -d --id.name peer2-org2 --id.secret peer2PW --id.type peer -u https://0.0.0.0:7055
fabric-ca-client register -d --id.name admin-org2 --id.secret org2AdminPW --id.type user -u https://0.0.0.0:7055
fabric-ca-client register -d --id.name user-org2 --id.secret org2UserPW --id.type user -u https://0.0.0.0:7055

注册org1 的节点peer1 1. 获取org1 的CA证书

mkdir -p /tmp/hyperledger/org1/peer1/assets/ca/
cp /tmp/hyperledger/org1/ca/crypto/ca-cert.pem /tmp/hyperledger/org1/peer1/assets/ca/org1-ca-cert.pem

2. 注册peer1

export FABRIC_CA_CLIENT_HOME=/tmp/hyperledger/org1/peer1
export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/org1/peer1/assets/ca/org1-ca-cert.pem
export FABRIC_CA_CLIENT_MSPDIR=msp
fabric-ca-client enroll -d -u https://peer1-org1:peer1PW@0.0.0.0:7054

3. 获取peer1 的TLS 加密并注册

1) mkdir -p /tmp/hyperledger/org1/peer1/assets/tls-ca/
 cp /tmp/hyperledger/tls-ca/crypto/tls-ca-cert.pem /tmp/hyperledger/org1/peer1/assets/tls-ca/tls-ca-cert.pem

2)export FABRIC_CA_CLIENT_MSPDIR=tls-msp
export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/org1/peer1/assets/tls-ca/tls-ca-cert.pem
fabric-ca-client enroll -d -u https://peer1-org1:peer1PW@0.0.0.0:7052 --enrollment.profile tls --csr.hosts peer1-org1

3)mv /tmp/hyperledger/org1/peer1/tls-msp/keystore/* /tmp/hyperledger/org1/peer1/tls-msp/keystore/key.pem

注册org1 的节点peer2 1. 获取org1 的CA证书

mkdir -p /tmp/hyperledger/org1/peer2/assets/ca/
cp /tmp/hyperledger/org1/ca/crypto/ca-cert.pem /tmp/hyperledger/org1/peer2/assets/ca/org1-ca-cert.pem

2. 注册peer2

export FABRIC_CA_CLIENT_HOME=/tmp/hyperledger/org1/peer2
export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/org1/peer2/assets/ca/org1-ca-cert.pem
export FABRIC_CA_CLIENT_MSPDIR=msp
fabric-ca-client enroll -d -u https://peer2-org1:peer2PW@0.0.0.0:7054

3. 获取peer2的TLS 加密并注册

1) mkdir -p /tmp/hyperledger/org1/peer2/assets/tls-ca/
 cp /tmp/hyperledger/tls-ca/crypto/tls-ca-cert.pem /tmp/hyperledger/org1/peer2/assets/tls-ca/tls-ca-cert.pem

2)export FABRIC_CA_CLIENT_MSPDIR=tls-msp
export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/org1/peer2/assets/tls-ca/tls-ca-cert.pem
fabric-ca-client enroll -d -u https://peer2-org1:peer2PW@0.0.0.0:7052 --enrollment.profile tls --csr.hosts peer2-org1

3)mv /tmp/hyperledger/org1/peer2/tls-msp/keystore/* /tmp/hyperledger/org1/peer2/tls-msp/keystore/key.pem

注册org1的管理员 1.注册

export FABRIC_CA_CLIENT_HOME=/tmp/hyperledger/org1/admin
export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/org1/peer1/assets/ca/org1-ca-cert.pem
export FABRIC_CA_CLIENT_MSPDIR=msp
fabric-ca-client enroll -d -u https://admin-org1:org1AdminPW@0.0.0.0:7054

mkdir /tmp/hyperledger/org1/peer1/msp/admincerts
cp /tmp/hyperledger/org1/admin/msp/signcerts/cert.pem /tmp/hyperledger/org1/peer1/msp/admincerts/org1-admin-cert.pem

2. 将org1/admin/msp下的证书cp 到peer节点中

mkdir /tmp/hyperledger/org1/peer1/msp/admincerts
cp /tmp/hyperledger/org1/admin/msp/signcerts/cert.pem /tmp/hyperledger/org1/peer1/msp/admincerts/org1-admin-cert.pem

mkdir /tmp/hyperledger/org1/peer2/msp/admincerts
cp /tmp/hyperledger/org1/admin/msp/signcerts/cert.pem /tmp/hyperledger/org1/peer2/msp/admincerts/org1-admin-cert.pem

3.启动org1的peer1、peer2

peer1-org1:
  container_name: peer1-org1
  image: hyperledger/fabric-peer
  environment:
    - CORE_PEER_ID=peer1-org1
    - CORE_PEER_ADDRESS=peer1-org1:7051
    - CORE_PEER_LOCALMSPID=org1MSP
    - CORE_PEER_MSPCONFIGPATH=/tmp/hyperledger/org1/peer1/msp
    - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
    - CORE_VM_DOCKER_HOSTCONFIG_NETWORKMODE=guide_fabric-ca
    - FABRIC_LOGGING_SPEC=debug
    - CORE_PEER_TLS_ENABLED=true
    - CORE_PEER_TLS_CERT_FILE=/tmp/hyperledger/org1/peer1/tls-msp/signcerts/cert.pem
    - CORE_PEER_TLS_KEY_FILE=/tmp/hyperledger/org1/peer1/tls-msp/keystore/key.pem
    - CORE_PEER_TLS_ROOTCERT_FILE=/tmp/hyperledger/org1/peer1/tls-msp/tlscacerts/tls-0-0-0-0-7052.pem
    - CORE_PEER_GOSSIP_USELEADERELECTION=true
    - CORE_PEER_GOSSIP_ORGLEADER=false
    - CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer1-org1:7051
    - CORE_PEER_GOSSIP_SKIPHANDSHAKE=true
  working_dir: /opt/gopath/src/github.com/hyperledger/fabric/org1/peer1
  volumes:
    - /var/run:/host/var/run
    - /tmp/hyperledger/org1/peer1:/tmp/hyperledger/org1/peer1
  networks:
    - fabric-ca

peer2-org1:
  container_name: peer2-org1
  image: hyperledger/fabric-peer
  environment:
    - CORE_PEER_ID=peer2-org1
    - CORE_PEER_ADDRESS=peer2-org1:7051
    - CORE_PEER_LOCALMSPID=org1MSP
    - CORE_PEER_MSPCONFIGPATH=/tmp/hyperledger/org1/peer2/msp
    - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
    - CORE_VM_DOCKER_HOSTCONFIG_NETWORKMODE=guide_fabric-ca
    - FABRIC_LOGGING_SPEC=grpc=debug:info
    - CORE_PEER_TLS_ENABLED=true
    - CORE_PEER_TLS_CERT_FILE=/tmp/hyperledger/org1/peer2/tls-msp/signcerts/cert.pem
    - CORE_PEER_TLS_KEY_FILE=/tmp/hyperledger/org1/peer2/tls-msp/keystore/key.pem
    - CORE_PEER_TLS_ROOTCERT_FILE=/tmp/hyperledger/org1/peer2/tls-msp/tlscacerts/tls-0-0-0-0-7052.pem
    - CORE_PEER_GOSSIP_USELEADERELECTION=true
    - CORE_PEER_GOSSIP_ORGLEADER=false
    - CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer2-org1:7051
    - CORE_PEER_GOSSIP_SKIPHANDSHAKE=true
    - CORE_PEER_GOSSIP_BOOTSTRAP=peer1-org1:7051
  working_dir: /opt/gopath/src/github.com/hyperledger/fabric/org1/peer2
  volumes:
    - /var/run:/host/var/run
    - /tmp/hyperledger/org1/peer2:/tmp/hyperledger/org1/peer2
  networks:
    - fabric-ca

docker-compose up -d peer1-org1
docker-compose up -d peer2-org1

4.查看peer节点状态

[root@10 fabric]# docker ps -a
CONTAINER ID   IMAGE                     COMMAND                  CREATED          STATUS          PORTS                                                 NAMES
2b7d1147d741   hyperledger/fabric-peer   "peer node start"        6 seconds ago    Up 4 seconds                                                 peer2-org1
fef2d1952d4b   hyperledger/fabric-peer   "peer node start"        12 seconds ago   Up 10 seconds                                                 peer1-org1
945dfba7fa98   hyperledger/fabric-ca     "/bin/bash -c 'fabri…"   19 minutes ago   Up 19 minutes   7054/tcp, 0.0.0.0:7055->7055/tcp, :::7055->7055/tcp   rca-org2
7d70b48b744f   hyperledger/fabric-ca     "sh -c 'fabric-ca-se…"   25 minutes ago   Up 25 minutes   0.0.0.0:7054->7054/tcp, :::7054->7054/tcp             rca-org1
ad553f6dcd0d   hyperledger/fabric-ca     "sh -c 'fabric-ca-se…"   26 minutes ago   Up 26 minutes   0.0.0.0:7053->7053/tcp, :::7053->7053/tcp, 7054/tcp   rca-org0
ef32ef95b701   hyperledger/fabric-ca     "sh -c 'fabric-ca-se…"   34 minutes ago   Up 34 minutes   0.0.0.0:7052->7052/tcp, :::7052->7052/tcp, 7054/tcp   ca-tls

注册org2 的节点peer1 1. 获取org2的CA证书

mkdir -p /tmp/hyperledger/org2/peer1/assets/ca/
cp /tmp/hyperledger/org2/ca/crypto/ca-cert.pem /tmp/hyperledger/org2/peer1/assets/ca/org2-ca-cert.pem

2.注册peer1

export FABRIC_CA_CLIENT_HOME=/tmp/hyperledger/org2/peer1
export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/org2/peer1/assets/ca/org2-ca-cert.pem
export FABRIC_CA_CLIENT_MSPDIR=msp
fabric-ca-client enroll -d -u https://peer1-org2:peer1PW@0.0.0.0:7055

3. 获取peer1 的TLS 加密并注册

1)  mkdir -p /tmp/hyperledger/org2/peer1/assets/tls-ca/
 cp /tmp/hyperledger/tls-ca/crypto/tls-ca-cert.pem /tmp/hyperledger/org2/peer1/assets/tls-ca/tls-ca-cert.pem

2) export FABRIC_CA_CLIENT_MSPDIR=tls-msp
export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/org2/peer1/assets/tls-ca/tls-ca-cert.pem
fabric-ca-client enroll -d -u https://peer1-org2:peer1PW@0.0.0.0:7052 --enrollment.profile tls --csr.hosts peer1-org2

3)mv /tmp/hyperledger/org2/peer1/tls-msp/keystore/* /tmp/hyperledger/org2/peer1/tls-msp/keystore/key.pem

注册org2的节点peer2 1. 获取org2的CA证书

mkdir -p /tmp/hyperledger/org2/peer2/assets/ca/
cp /tmp/hyperledger/org2/ca/crypto/ca-cert.pem /tmp/hyperledger/org2/peer2/assets/ca/org2-ca-cert.pem

2.注册peer2

export FABRIC_CA_CLIENT_HOME=/tmp/hyperledger/org2/peer2
export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/org2/peer2/assets/ca/org2-ca-cert.pem
export FABRIC_CA_CLIENT_MSPDIR=msp
fabric-ca-client enroll -d -u https://peer2-org2:peer2PW@0.0.0.0:7055

3. 获取peer2 的TLS 加密并注册

1)  mkdir -p /tmp/hyperledger/org2/peer2/assets/tls-ca/
cp /tmp/hyperledger/tls-ca/crypto/tls-ca-cert.pem /tmp/hyperledger/org2/peer2/assets/tls-ca/tls-ca-cert.pem

2) export FABRIC_CA_CLIENT_MSPDIR=tls-msp
export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/org2/peer2/assets/tls-ca/tls-ca-cert.pem
fabric-ca-client enroll -d -u https://peer2-org2:peer2PW@0.0.0.0:7052 --enrollment.profile tls --csr.hosts peer2-org2

3)mv /tmp/hyperledger/org2/peer2/tls-msp/keystore/* /tmp/hyperledger/org2/peer2/tls-msp/keystore/key.pem

注册org2的管理员 1.注册

export FABRIC_CA_CLIENT_HOME=/tmp/hyperledger/org2/admin
export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/org2/peer1/assets/ca/org2-ca-cert.pem
export FABRIC_CA_CLIENT_MSPDIR=msp
fabric-ca-client enroll -d -u https://admin-org2:org2AdminPW@0.0.0.0:7055

mkdir /tmp/hyperledger/org2/peer1/msp/admincerts
cp /tmp/hyperledger/org2/admin/msp/signcerts/cert.pem /tmp/hyperledger/org2/peer1/msp/admincerts/org2-admin-cert.pem

2. 将org2/admin/msp下的证书cp 到peer节点中

mkdir /tmp/hyperledger/org2/peer1/msp/admincerts
cp /tmp/hyperledger/org2/admin/msp/signcerts/cert.pem /tmp/hyperledger/org2/peer1/msp/admincerts/org2-admin-cert.pem

mkdir /tmp/hyperledger/org2/peer2/msp/admincerts
cp /tmp/hyperledger/org2/admin/msp/signcerts/cert.pem /tmp/hyperledger/org2/peer2/msp/admincerts/org2-admin-cert.pem

3.启动org2的peer1、peer2

peer1-org2:
  container_name: peer1-org2
  image: hyperledger/fabric-peer
  environment:
    - CORE_PEER_ID=peer1-org2
    - CORE_PEER_ADDRESS=peer1-org2:7051
    - CORE_PEER_LOCALMSPID=org2MSP
    - CORE_PEER_MSPCONFIGPATH=/tmp/hyperledger/org2/peer1/msp
    - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
    - CORE_VM_DOCKER_HOSTCONFIG_NETWORKMODE=guide_fabric-ca
    - FABRIC_LOGGING_SPEC=debug
    - CORE_PEER_TLS_ENABLED=true
    - CORE_PEER_TLS_CERT_FILE=/tmp/hyperledger/org2/peer1/tls-msp/signcerts/cert.pem
    - CORE_PEER_TLS_KEY_FILE=/tmp/hyperledger/org2/peer1/tls-msp/keystore/key.pem
    - CORE_PEER_TLS_ROOTCERT_FILE=/tmp/hyperledger/org2/peer1/tls-msp/tlscacerts/tls-0-0-0-0-7052.pem
    - CORE_PEER_GOSSIP_USELEADERELECTION=true
    - CORE_PEER_GOSSIP_ORGLEADER=false
    - CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer1-org2:7051
    - CORE_PEER_GOSSIP_SKIPHANDSHAKE=true
  working_dir: /opt/gopath/src/github.com/hyperledger/fabric/org2/peer1
  volumes:
    - /var/run:/host/var/run
    - /tmp/hyperledger/org2/peer1:/tmp/hyperledger/org2/peer1
  networks:
    - fabric-ca

peer2-org2:
  container_name: peer2-org2
  image: hyperledger/fabric-peer
  environment:
    - CORE_PEER_ID=peer2-org2
    - CORE_PEER_ADDRESS=peer2-org2:7051
    - CORE_PEER_LOCALMSPID=org2MSP
    - CORE_PEER_MSPCONFIGPATH=/tmp/hyperledger/org2/peer2/msp
    - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
    - CORE_VM_DOCKER_HOSTCONFIG_NETWORKMODE=guide_fabric-ca
    - FABRIC_LOGGING_SPEC=debug
    - CORE_PEER_TLS_ENABLED=true
    - CORE_PEER_TLS_CERT_FILE=/tmp/hyperledger/org2/peer2/tls-msp/signcerts/cert.pem
    - CORE_PEER_TLS_KEY_FILE=/tmp/hyperledger/org2/peer2/tls-msp/keystore/key.pem
    - CORE_PEER_TLS_ROOTCERT_FILE=/tmp/hyperledger/org2/peer2/tls-msp/tlscacerts/tls-0-0-0-0-7052.pem
    - CORE_PEER_GOSSIP_USELEADERELECTION=true
    - CORE_PEER_GOSSIP_ORGLEADER=false
    - CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer2-org2:7051
    - CORE_PEER_GOSSIP_SKIPHANDSHAKE=true
    - CORE_PEER_GOSSIP_BOOTSTRAP=peer1-org2:7051
  working_dir: /opt/gopath/src/github.com/hyperledger/fabric/org2/peer2
  volumes:
    - /var/run:/host/var/run
    - /tmp/hyperledger/org2/peer2:/tmp/hyperledger/org2/peer2
  networks:
    - fabric-ca
```bash
[root@10 fabric]# docker ps -a
CONTAINER ID   IMAGE                     COMMAND                  CREATED             STATUS PORTS                                                 NAMES
81f32b4d987c   hyperledger/fabric-peer   "peer node start"        13 seconds ago      Up 11 seconds                                                       peer2-org2
87392ed96282   hyperledger/fabric-peer   "peer node start"        17 seconds ago      Up 16 seconds                                                       peer1-org2
2b7d1147d741   hyperledger/fabric-peer   "peer node start"        51 minutes ago      Up 51 minutes                                                       peer2-org1
fef2d1952d4b   hyperledger/fabric-peer   "peer node start"        51 minutes ago      Up 51 minutes                                                       peer1-org1
945dfba7fa98   hyperledger/fabric-ca     "/bin/bash -c 'fabri…"   About an hour ago   Up About an hour 7054/tcp, 0.0.0.0:7055->7055/tcp, :::7055->7055/tcp   rca-org2
7d70b48b744f   hyperledger/fabric-ca     "sh -c 'fabric-ca-se…"   About an hour ago   Up About an hour 0.0.0.0:7054->7054/tcp, :::7054->7054/tcp             rca-org1
ad553f6dcd0d   hyperledger/fabric-ca     "sh -c 'fabric-ca-se…"   About an hour ago   Up About an hour 0.0.0.0:7053->7053/tcp, :::7053->7053/tcp, 7054/tcp   rca-org0
ef32ef95b701   hyperledger/fabric-ca     "sh -c 'fabric-ca-se…"   About an hour ago   Up About an hour 0.0.0.0:7052->7052/tcp, :::7052->7052/tcp, 7054/tcp   ca-tls

查看peer节点状态

[root@10 fabric]# docker ps -a
CONTAINER ID   IMAGE                     COMMAND                  CREATED             STATUS PORTS                                                 NAMES
81f32b4d987c   hyperledger/fabric-peer   "peer node start"        13 seconds ago      Up 11 seconds                                                       peer2-org2
87392ed96282   hyperledger/fabric-peer   "peer node start"        17 seconds ago      Up 16 seconds                                                       peer1-org2
2b7d1147d741   hyperledger/fabric-peer   "peer node start"        51 minutes ago      Up 51 minutes                                                       peer2-org1
fef2d1952d4b   hyperledger/fabric-peer   "peer node start"        51 minutes ago      Up 51 minutes                                                       peer1-org1
945dfba7fa98   hyperledger/fabric-ca     "/bin/bash -c 'fabri…"   About an hour ago   Up About an hour 7054/tcp, 0.0.0.0:7055->7055/tcp, :::7055->7055/tcp   rca-org2
7d70b48b744f   hyperledger/fabric-ca     "sh -c 'fabric-ca-se…"   About an hour ago   Up About an hour 0.0.0.0:7054->7054/tcp, :::7054->7054/tcp             rca-org1
ad553f6dcd0d   hyperledger/fabric-ca     "sh -c 'fabric-ca-se…"   About an hour ago   Up About an hour 0.0.0.0:7053->7053/tcp, :::7053->7053/tcp, 7054/tcp   rca-org0
ef32ef95b701   hyperledger/fabric-ca     "sh -c 'fabric-ca-se…"   About an hour ago   Up About an hour 0.0.0.0:7052->7052/tcp, :::7052->7052/tcp, 7054/tcp   ca-tls

设置排序服务 1.注册orderer

mkdir -p /tmp/hyperledger/org0/orderer/assets/ca
cp /tmp/hyperledger/org0/ca/crypto/ca-cert.pem /tmp/hyperledger/org0/orderer/assets/ca/org0-ca-cert.pem

export FABRIC_CA_CLIENT_HOME=/tmp/hyperledger/org0/orderer
export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/org0/orderer/assets/ca/org0-ca-cert.pem
fabric-ca-client enroll -d -u https://orderer1-org0:ordererpw@0.0.0.0:7053

2. TLS CA

mkdir -p /tmp/hyperledger/org0/orderer/assets/tls-ca/
cp /tmp/hyperledger/tls-ca/crypto/tls-ca-cert.pem /tmp/hyperledger/org0/orderer/assets/tls-ca/

3.注册 Org0 的管理员

export FABRIC_CA_CLIENT_HOME=/tmp/hyperledger/org0/admin
export FABRIC_CA_CLIENT_TLS_CERTFILES=/tmp/hyperledger/org0/orderer/assets/ca/org0-ca-cert.pem
export FABRIC_CA_CLIENT_MSPDIR=msp
fabric-ca-client enroll -d -u https://admin-org0:org0adminpw@0.0.0.0:7053

mkdir /tmp/hyperledger/org0/orderer/msp/admincerts
cp /tmp/hyperledger/org0/admin/msp/signcerts/cert.pem /tmp/hyperledger/org0/orderer/msp/admincerts/orderer-admin-cert.pem

欢迎分享，转载请注明来源：内存溢出

原文地址: http://outofmemory.cn/zaji/1319648.html

Fabric CA 学习记录

发表评论

评论列表（0条）