Skip to content

Commit 7a42145

Browse files
ghaskinsghaskins
committed
[FAB-3710] /examples/cluster: configure CA
We need to ensure we configure the CA with the MSP artifacts or it will be unable to generate usable ECerts. Change-Id: Iec5f1bf033d92a9d11ab7feca2aaf3e78eac8d78 Signed-off-by: Greg Haskins <[email protected]>
1 parent c346b06 commit 7a42145

File tree

3 files changed

+244
-7
lines changed

3 files changed

+244
-7
lines changed

‎examples/cluster/Makefile

+4-4
Original file line numberDiff line numberDiff line change
@@ -95,10 +95,10 @@ build/nodes/orderer: build/nodes/orderer/orderer.yaml
9595
build/nodes/orderer: build/nodes/orderer/genesis.block
9696
build/nodes/cli: $(CHANNEL_TXNS)
9797

98-
build/nodes/ca:
99-
@mkdir -p $@/tls
100-
cp $(CA_PATH)/*_sk $@/tls/ca.key
101-
cp $(CA_PATH)/*.pem $@/tls/ca.crt
98+
build/nodes/ca: build/nodes/ca/fabric-ca-server-config.yaml
99+
@mkdir -p $@
100+
cp $(CA_PATH)/*_sk $@/ca.key
101+
cp $(CA_PATH)/*.pem $@/ca.crt
102102

103103
build/nodes/%: build/nodes/%/msp build/nodes/%/configtx.yaml build/nodes/%/core.yaml
104104
@echo "Built $@"

‎examples/cluster/compose/docker-compose.yaml

+1-3
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,13 @@ services:
88
dns_search: .
99
environment:
1010
- FABRIC_CA_SERVER_TLS_ENABLED=${TLS_ENABLED}
11-
- FABRIC_CA_SERVER_TLS_CERTFILE=/etc/hyperledger/fabric-ca-server/tls/ca.crt
12-
- FABRIC_CA_SERVER_TLS_KEYFILE=/etc/hyperledger/fabric-ca-server/tls/ca.key
1311
logging: &logging
1412
driver: json-file
1513
options:
1614
max-size: "25m"
1715
max-file: "2"
1816
volumes:
19-
- ../build/nodes/ca/tls:/etc/hyperledger/fabric-ca-server/tls
17+
- ../build/nodes/ca:/etc/hyperledger/fabric-ca-server
2018

2119
orderer:
2220
container_name: orderer

‎examples/cluster/config/fabric-ca-server-config.yaml

+239
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,239 @@
1+
#############################################################################
2+
# This is a configuration file for the fabric-ca-server command.
3+
#
4+
# COMMAND LINE ARGUMENTS AND ENVIRONMENT VARIABLES
5+
# ------------------------------------------------
6+
# Each configuration element can be overridden via command line
7+
# arguments or environment variables. The precedence for determining
8+
# the value of each element is as follows:
9+
# 1) command line argument
10+
# Examples:
11+
# a) --port 443
12+
# To set the listening port
13+
# b) --ca-keyfile ../mykey.pem
14+
# To set the "keyfile" element in the "ca" section below;
15+
# note the '-' separator character.
16+
# 2) environment variable
17+
# Examples:
18+
# a) FABRIC_CA_SERVER_PORT=443
19+
# To set the listening port
20+
# b) FABRIC_CA_SERVER_CA_KEYFILE="../mykey.pem"
21+
# To set the "keyfile" element in the "ca" section below;
22+
# note the '_' separator character.
23+
# 3) configuration file
24+
# 4) default value (if there is one)
25+
# All default values are shown beside each element below.
26+
#
27+
# FILE NAME ELEMENTS
28+
# ------------------
29+
# All filename elements below end with the word "file".
30+
# For example, see "certfile" and "keyfile" in the "ca" section.
31+
# The value of each filename element can be a simple filename, a
32+
# relative path, or an absolute path. If the value is not an
33+
# absolute path, it is interpretted as being relative to the location
34+
# of this configuration file.
35+
#
36+
#############################################################################
37+
38+
# Server's listening port (default: 7054)
39+
port: 7054
40+
41+
# Enables debug logging (default: false)
42+
debug: false
43+
44+
#############################################################################
45+
# TLS section for the server's listening port
46+
#
47+
# The following types are supported for client authentication: NoClientCert,
48+
# RequestClientCert, RequireAnyClientCert, VerfiyClientCertIfGiven,
49+
# and RequireAndVerifyClientCert.
50+
#
51+
# Certfiles is a list of root certificate authorities that the server uses
52+
# when verifying client certificates.
53+
#############################################################################
54+
tls:
55+
# Enable TLS (default: false)
56+
enabled: false
57+
# TLS for the server's listening port
58+
certfile: ca.crt
59+
keyfile: ca.key
60+
clientauth:
61+
type: noclientcert
62+
certfiles:
63+
64+
#############################################################################
65+
# The CA section contains information related to the Certificate Authority
66+
# including the name of the CA, which should be unique for all members
67+
# of a blockchain network. It also includes the key and certificate files
68+
# used when issuing enrollment certificates (ECerts) and transaction
69+
# certificates (TCerts).
70+
# The chainfile (if it exists) contains the certificate chain which
71+
# should be trusted for this CA, where the 1st in the chain is always the
72+
# root CA certificate.
73+
#############################################################################
74+
ca:
75+
# Name of this CA
76+
name:
77+
certfile: ca.crt
78+
keyfile: ca.key
79+
# Chain file (default: chain-cert.pem)
80+
chainfile: ca-chain.pem
81+
82+
#############################################################################
83+
# The registry section controls how the fabric-ca-server does two things:
84+
# 1) authenticates enrollment requests which contain a username and password
85+
# (also known as an enrollment ID and secret).
86+
# 2) once authenticated, retrieves the identity's attribute names and
87+
# values which the fabric-ca-server optionally puts into TCerts
88+
# which it issues for transacting on the Hyperledger Fabric blockchain.
89+
# These attributes are useful for making access control decisions in
90+
# chaincode.
91+
# There are two main configuration options:
92+
# 1) The fabric-ca-server is the registry
93+
# 2) An LDAP server is the registry, in which case the fabric-ca-server
94+
# calls the LDAP server to perform these tasks.
95+
#############################################################################
96+
registry:
97+
# Maximum number of times a password/secret can be reused for enrollment
98+
# (default: 0, which means there is no limit)
99+
maxEnrollments: 0
100+
101+
# Contains identity information which is used when LDAP is disabled
102+
identities:
103+
- name: admin
104+
pass: adminpw
105+
type: client
106+
affiliation: ""
107+
attrs:
108+
hf.Registrar.Roles: "client,user,peer,validator,auditor,ca"
109+
hf.Registrar.DelegateRoles: "client,user,validator,auditor"
110+
hf.Revoker: true
111+
hf.IntermediateCA: true
112+
113+
#############################################################################
114+
# Database section
115+
# Supported types are: "sqlite3", "postgres", and "mysql".
116+
# The datasource value depends on the type.
117+
# If the type is "sqlite3", the datasource value is a file name to use
118+
# as the database store. Since "sqlite3" is an embedded database, it
119+
# may not be used if you want to run the fabric-ca-server in a cluster.
120+
# To run the fabric-ca-server in a cluster, you must choose "postgres"
121+
# or "mysql".
122+
#############################################################################
123+
db:
124+
type: sqlite3
125+
datasource: /var/hyperledger/fabric-ca-server.db
126+
tls:
127+
enabled: false
128+
certfiles:
129+
- db-server-cert.pem
130+
client:
131+
certfile: db-client-cert.pem
132+
keyfile: db-client-key.pem
133+
134+
#############################################################################
135+
# LDAP section
136+
# If LDAP is enabled, the fabric-ca-server calls LDAP to:
137+
# 1) authenticate enrollment ID and secret (i.e. username and password)
138+
# for enrollment requests;
139+
# 2) To retrieve identity attributes
140+
#############################################################################
141+
ldap:
142+
# Enables or disables the LDAP client (default: false)
143+
enabled: false
144+
# The URL of the LDAP server
145+
url: ldap://<adminDN>:<adminPassword>@<host>:<port>/<base>
146+
tls:
147+
certfiles:
148+
- ldap-server-cert.pem
149+
client:
150+
certfile: ldap-client-cert.pem
151+
keyfile: ldap-client-key.pem
152+
153+
#############################################################################
154+
# Affiliation section
155+
#############################################################################
156+
affiliations:
157+
org1:
158+
- department1
159+
- department2
160+
org2:
161+
- department1
162+
163+
#############################################################################
164+
# Signing section
165+
#############################################################################
166+
signing:
167+
profiles:
168+
ca:
169+
usage:
170+
- cert sign
171+
expiry: 8000h
172+
caconstraint:
173+
isca: true
174+
default:
175+
usage:
176+
- cert sign
177+
expiry: 8000h
178+
179+
###########################################################################
180+
# Certificate Signing Request section for generating the CA certificate
181+
###########################################################################
182+
csr:
183+
cn: fabric-ca-server
184+
names:
185+
- C: US
186+
ST: "North Carolina"
187+
L:
188+
O: Hyperledger
189+
OU: Fabric
190+
hosts:
191+
- 2008f00aff38
192+
ca:
193+
pathlen:
194+
pathlenzero:
195+
expiry:
196+
197+
#############################################################################
198+
# BCCSP (BlockChain Crypto Service Provider) section is used to select which
199+
# crypto library implementation to use
200+
#############################################################################
201+
202+
bccsp:
203+
default: SW
204+
sw:
205+
hash: SHA2
206+
security: 256
207+
filekeystore:
208+
# The directory used for the software file-based keystore
209+
keystore: keystore
210+
211+
#############################################################################
212+
# The fabric-ca-server init and start commands support the following two
213+
# additional mutually exclusive options:
214+
#
215+
# 1) --cacount <number-of-CAs>
216+
# Automatically generate multiple default CA instances.
217+
# This is particularly useful in a development environment to quickly set up
218+
# multiple CAs.
219+
# For example,
220+
# fabric-ca-server start -b admin:adminpw --cacount 2
221+
# starts a server with a default CA and two non-default CA's with names
222+
# 'ca1' and 'ca2'.
223+
#
224+
# 2) --cafiles <CA-config-files>
225+
# For each CA config file in the list, generate a separate signing CA. Each CA
226+
# config file in this list MAY contain all of the same elements as are found in
227+
# the server config file except port, debug, and tls sections.
228+
# For example,
229+
# fabric-ca-server start -b admin:adminpw \
230+
# --cafiles ca/ca1/fabric-ca-server-config.yaml \
231+
# --cafiles ca/ca2/fabric-ca-server-config.yaml
232+
# is equivalent to the previous example, except the files CA config files
233+
# must already exist and can be customized.
234+
#
235+
#############################################################################
236+
237+
cacount:
238+
239+
cafiles:

0 commit comments

Comments
 (0)