Hyperledger Fabric的CA操作指南-part1

简介

作为许可的区块链平台,Hyperledger Fabric要求识别所有实体,无论是网络组件还是使用该平台的用户(客户端)。该识别通过数字证书来实现,并且需要用于证书发颁发和管理的基础设施。

虽然可以使用第三方来构建这个基础设施,但是Fabric CA提供了一种方便的方法,它可以生成Hyperledger Fabric系统所需的适当格式。在readthedoc中有一个很好的教程,《 Fabric CA操作指南》。它创建了一个典型的设置,并提供了非常详细的逐步说明。在实验过程中,我们会在各个角度进行某些观察以获得更全面的了解。同时,为了更好地工作,我还修正了一些命名不一致的问题,并更新了配置文件。希望这对您在学习本教程时有所帮助。

教程概述

Organization设置

整个设置总结如下:

1. 三个Organization:org0 是orderer organization, org1和org2 是peer organizations


2. org0有一个orderer(orderer1-org0),用于在Solo中提供orderer服务。


3. 在每个peer organizations(org1和org2)中,都有peer organizations(peer1-orgx,peer2-orgx)


4. 每个Organization都有一个管理员用户(admin-orgx)

以下是总体情况,供我们参考。我们将在下一部分立即解释最后一个专栏。

Hyperledger Fabric的CA操作指南-part1

Hyperledger Fabric的CA操作指南-part1

证书颁发机构设置

如果从CA角度看设置,那么本教程中有四个CA:

· TLS-CA:CA为整个网络的网络组件(订购者和对等方)颁发TLS服务器证书。该证书仅用于TLS通信,并且与该结构网络中的身份有关。
· RCA-ORGx(x = 0,1,2):它是每个organization中身份的根CA。一方面,它向组件和用户颁发所需的证书。另一方面,它代表形成结构网络时的organization(以MSP方式)。

最后一列供快速参考。我们将在本教程的后面部分看到这些目录。


Hyperledger Fabric的CA操作指南-part1

本教程中使用的CA的摘要

Hyperledger Fabric的CA操作指南-part1

完成证书颁发并完成结构网络设置后,在日常操作中不需要这些ca。他们不参与加入通道,部署链码,调用链码功能等。仅当新组件(添加一个orderer或多个peer)或新用户(添加更多客户端应用程序)加入设置和新证书时才需要它们生成。

操作流程:

这是本教程的整体流程(注意:这只是显示了一系列任务,此处显示的步骤不是教程中显示的步骤)

1. 启动四个CA,每个CA作为运行在容器中的Fabric-CA-Server。
2. 在localhost使用Fabric-CA-Client与这些CA进行交互。对于每个CA,请注册一个注册商,然后根据我们的教程设计开始所有organization的实体注册。
3. 对于每个organization,请使用Fabric-CA-Client来注册在2中注册的实体。现在,我们拥有所需的所有加密材料。
4. 将生成的加密材料放置在适当的目录中,这些目录将映射到docker-compose文件中定义的那些组件(order和peer)中。
5. 为每个组织准备MSP目录,创建结构网络时需要该目录。
6. 打开五个容器(一个order,四个peer)和两个CLI容器。
7. 创建通道并将peers连接到通道
8. 部署链码并观察链码中基于属性的访问控制(ABAC)功能。

配置文件

有两个配置文件:docker-compose文件(docker-compose.yaml)和通道工件文件(configtx.yaml)。

docker-compose.yaml被修改和更新以反映更改。

version: ‘2’

networks:
  fabric-ca:

services:
  ca-tls:
    container_name: ca-tls
    image: hyperledger/fabric-ca:1.4.2
    command: sh -c ‘fabric-ca-server start -d -b tls-ca-admin:tls-ca-adminpw –port 7052’
    environment:
        – FABRIC_CA_SERVER_HOME=/tmp/hyperledger/fabric-ca/crypto
        – FABRIC_CA_SERVER_TLS_ENABLED=true
        – FABRIC_CA_SERVER_CSR_CN=tls-ca
        – FABRIC_CA_SERVER_CSR_HOSTS=0.0.0.0
        – FABRIC_CA_SERVER_DEBUG=true
    volumes:
        – /tmp/hyperledger/tls-ca:/tmp/hyperledger/fabric-ca
    networks:
        – fabric-ca
    ports:
        – 7052:7052

  rca-org0:
    container_name: rca-org0
    image: hyperledger/fabric-ca:1.4.2
    command: sh -c ‘fabric-ca-server start -d -b rca-org0-admin:rca-org0-adminpw –port 7053’
    environment:
        – FABRIC_CA_SERVER_HOME=/tmp/hyperledger/fabric-ca/crypto
        – FABRIC_CA_SERVER_TLS_ENABLED=true
        – FABRIC_CA_SERVER_CSR_CN=rca-org0
        – FABRIC_CA_SERVER_CSR_HOSTS=0.0.0.0
        – FABRIC_CA_SERVER_DEBUG=true
    volumes:
        – /tmp/hyperledger/org0/ca:/tmp/hyperledger/fabric-ca
    networks:
        – fabric-ca
    ports:
        – 7053:7053

  rca-org1:
    container_name: rca-org1
    image: hyperledger/fabric-ca:1.4.2
    command: sh -c ‘fabric-ca-server start -d -b rca-org1-admin:rca-org1-adminpw –port 7054’
    environment:
        – FABRIC_CA_SERVER_HOME=/tmp/hyperledger/fabric-ca/crypto
        – FABRIC_CA_SERVER_TLS_ENABLED=true
        – FABRIC_CA_SERVER_CSR_CN=rca-org1
        – FABRIC_CA_SERVER_CSR_HOSTS=0.0.0.0
        – FABRIC_CA_SERVER_DEBUG=true
    volumes:
        – /tmp/hyperledger/org1/ca:/tmp/hyperledger/fabric-ca
    networks:
        – fabric-ca
    ports:
        – 7054:7054

  rca-org2:
    container_name: rca-org2
    image: hyperledger/fabric-ca:1.4.2
    command: /bin/bash -c ‘fabric-ca-server start -d -b rca-org2-admin:rca-org2-adminpw –port 7055’
    environment:
        – FABRIC_CA_SERVER_HOME=/tmp/hyperledger/fabric-ca/crypto
        – FABRIC_CA_SERVER_TLS_ENABLED=true
        – FABRIC_CA_SERVER_CSR_CN=rca-org2
        – FABRIC_CA_SERVER_CSR_HOSTS=0.0.0.0
        – FABRIC_CA_SERVER_DEBUG=true
    volumes:
        – /tmp/hyperledger/org2/ca:/tmp/hyperledger/fabric-ca
    networks:
        – fabric-ca
    ports:
        – 7055:7055

  peer1-org1:
    container_name: peer1-org1
    image: hyperledger/fabric-peer:1.4.2
    environment:
        – CORE_PEER_ID=peer1-org1
        – CORE_PEER_ADDRESS=peer1-org1:7051
        – CORE_PEER_LOCALMSPID=org1MSP
        – CORE_PEER_MSPCONFIGPATH=/tmp/hyperledger/org1/peer1/msp
        – CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
        – CORE_VM_DOCKER_HOSTCONFIG_NETWORKMODE=guide_fabric-ca
        – FABRIC_LOGGING_SPEC=info
        – CORE_PEER_TLS_ENABLED=true
        – CORE_PEER_TLS_CERT_FILE=/tmp/hyperledger/org1/peer1/tls-msp/signcerts/cert.pem
        – CORE_PEER_TLS_KEY_FILE=/tmp/hyperledger/org1/peer1/tls-msp/keystore/key.pem
        – CORE_PEER_TLS_ROOTCERT_FILE=/tmp/hyperledger/org1/peer1/tls-msp/tlscacerts/tls-0-0-0-0-7052.pem
        – CORE_PEER_GOSSIP_USELEADERELECTION=true
        – CORE_PEER_GOSSIP_ORGLEADER=false
        – CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer1-org1:7051
        – CORE_PEER_GOSSIP_SKIPHANDSHAKE=true
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/org1/peer1
    volumes:
        – /var/run:/host/var/run
        – /tmp/hyperledger/org1/peer1:/tmp/hyperledger/org1/peer1
    networks:
        – fabric-ca

  peer2-org1:
    container_name: peer2-org1
    image: hyperledger/fabric-peer:1.4.2
    environment:
        – CORE_PEER_ID=peer2-org1
        – CORE_PEER_ADDRESS=peer2-org1:7051
        – CORE_PEER_LOCALMSPID=org1MSP
        – CORE_PEER_MSPCONFIGPATH=/tmp/hyperledger/org1/peer2/msp
        – CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
        – CORE_VM_DOCKER_HOSTCONFIG_NETWORKMODE=guide_fabric-ca
        – FABRIC_LOGGING_SPEC=info
        – CORE_PEER_TLS_ENABLED=true
        – CORE_PEER_TLS_CERT_FILE=/tmp/hyperledger/org1/peer2/tls-msp/signcerts/cert.pem
        – CORE_PEER_TLS_KEY_FILE=/tmp/hyperledger/org1/peer2/tls-msp/keystore/key.pem
        – CORE_PEER_TLS_ROOTCERT_FILE=/tmp/hyperledger/org1/peer2/tls-msp/tlscacerts/tls-0-0-0-0-7052.pem
        – CORE_PEER_GOSSIP_USELEADERELECTION=true
        – CORE_PEER_GOSSIP_ORGLEADER=false
        – CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer2-org1:7051
        – CORE_PEER_GOSSIP_SKIPHANDSHAKE=true
        – CORE_PEER_GOSSIP_BOOTSTRAP=peer1-org1:7051
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/org1/peer2
    volumes:
        – /var/run:/host/var/run
        – /tmp/hyperledger/org1/peer2:/tmp/hyperledger/org1/peer2
    networks:
        – fabric-ca

  peer1-org2:
    container_name: peer1-org2
    image: hyperledger/fabric-peer:1.4.2
    environment:
        – CORE_PEER_ID=peer1-org2
        – CORE_PEER_ADDRESS=peer1-org2:7051
        – CORE_PEER_LOCALMSPID=org2MSP
        – CORE_PEER_MSPCONFIGPATH=/tmp/hyperledger/org2/peer1/msp
        – CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
        – CORE_VM_DOCKER_HOSTCONFIG_NETWORKMODE=guide_fabric-ca
        – FABRIC_LOGGING_SPEC=info
        – CORE_PEER_TLS_ENABLED=true
        – CORE_PEER_TLS_CERT_FILE=/tmp/hyperledger/org2/peer1/tls-msp/signcerts/cert.pem
        – CORE_PEER_TLS_KEY_FILE=/tmp/hyperledger/org2/peer1/tls-msp/keystore/key.pem
        – CORE_PEER_TLS_ROOTCERT_FILE=/tmp/hyperledger/org2/peer1/tls-msp/tlscacerts/tls-0-0-0-0-7052.pem
        – CORE_PEER_GOSSIP_USELEADERELECTION=true
        – CORE_PEER_GOSSIP_ORGLEADER=false
        – CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer1-org2:7051
        – CORE_PEER_GOSSIP_SKIPHANDSHAKE=true
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/org2/peer1
    volumes:
        – /var/run:/host/var/run
        – /tmp/hyperledger/org2/peer1:/tmp/hyperledger/org2/peer1
    networks:
        – fabric-ca

  peer2-org2:
    container_name: peer2-org2
    image: hyperledger/fabric-peer:1.4.2
    environment:
        – CORE_PEER_ID=peer2-org2
        – CORE_PEER_ADDRESS=peer2-org2:7051
        – CORE_PEER_LOCALMSPID=org2MSP
        – CORE_PEER_MSPCONFIGPATH=/tmp/hyperledger/org2/peer2/msp
        – CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
        – CORE_VM_DOCKER_HOSTCONFIG_NETWORKMODE=guide_fabric-ca
        – FABRIC_LOGGING_SPEC=info
        – CORE_PEER_TLS_ENABLED=true
        – CORE_PEER_TLS_CERT_FILE=/tmp/hyperledger/org2/peer2/tls-msp/signcerts/cert.pem
        – CORE_PEER_TLS_KEY_FILE=/tmp/hyperledger/org2/peer2/tls-msp/keystore/key.pem
        – CORE_PEER_TLS_ROOTCERT_FILE=/tmp/hyperledger/org2/peer2/tls-msp/tlscacerts/tls-0-0-0-0-7052.pem
        – CORE_PEER_GOSSIP_USELEADERELECTION=true
        – CORE_PEER_GOSSIP_ORGLEADER=false
        – CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer2-org2:7051
        – CORE_PEER_GOSSIP_SKIPHANDSHAKE=true
        – CORE_PEER_GOSSIP_BOOTSTRAP=peer1-org2:7051
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/org2/peer2
    volumes:
        – /var/run:/host/var/run
        – /tmp/hyperledger/org2/peer2:/tmp/hyperledger/org2/peer2
    networks:
        – fabric-ca

  orderer1-org0:
    container_name: orderer1-org0
    image: hyperledger/fabric-orderer:1.4.2
    environment:
        – ORDERER_HOME=/tmp/hyperledger/orderer
        – ORDERER_HOST=orderer1-org0
        – ORDERER_GENERAL_LISTENADDRESS=0.0.0.0
        – ORDERER_GENERAL_GENESISMETHOD=file
        – ORDERER_GENERAL_GENESISFILE=/tmp/hyperledger/org0/orderer/genesis.block
        – ORDERER_GENERAL_LOCALMSPID=org0MSP
        – ORDERER_GENERAL_LOCALMSPDIR=/tmp/hyperledger/org0/orderer/msp
        – ORDERER_GENERAL_TLS_ENABLED=true
        – ORDERER_GENERAL_TLS_CERTIFICATE=/tmp/hyperledger/org0/orderer/tls-msp/signcerts/cert.pem
        – ORDERER_GENERAL_TLS_PRIVATEKEY=/tmp/hyperledger/org0/orderer/tls-msp/keystore/key.pem
        – ORDERER_GENERAL_TLS_ROOTCAS=[/tmp/hyperledger/org0/orderer/tls-msp/tlscacerts/tls-0-0-0-0-7052.pem]
        – ORDERER_GENERAL_LOGLEVEL=debug
        – ORDERER_DEBUG_BROADCASTTRACEDIR=data/logs
    volumes:
        – /tmp/hyperledger/org0/orderer:/tmp/hyperledger/org0/orderer/
    networks:
        – fabric-ca

  cli-org1:
    container_name: cli-org1
    image: hyperledger/fabric-tools:1.4.2
    tty: true
    stdin_open: true
    environment:
        – GOPATH=/opt/gopath
        – FABRIC_LOGGING_SPEC=INFO
        – CORE_PEER_ID=cli
        – CORE_PEER_ADDRESS=peer1-org1:7051
        – CORE_PEER_LOCALMSPID=org1MSP
        – CORE_PEER_TLS_ENABLED=true
        – CORE_PEER_TLS_ROOTCERT_FILE=/tmp/hyperledger/org1/peer1/tls-msp/tlscacerts/tls-0-0-0-0-7052.pem
        – CORE_PEER_MSPCONFIGPATH=/tmp/hyperledger/org1/admin/msp
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/org1
    command: sh
    volumes:
        – /tmp/hyperledger/org1/peer1:/tmp/hyperledger/org1/peer1
        – /tmp/hyperledger/org1/peer2:/tmp/hyperledger/org1/peer2
        – /Users/kctam/hf142/fabric-samples/chaincode:/opt/gopath/src/github.com/hyperledger/fabric-samples/chaincode
        – /tmp/hyperledger/org1/admin:/tmp/hyperledger/org1/admin
    networks:
        – fabric-ca

  cli-org2:
   container_name: cli-org2
   image: hyperledger/fabric-tools:1.4.2
   tty: true
   stdin_open: true
   environment:
      – GOPATH=/opt/gopath
      – FABRIC_LOGGING_SPEC=INFO
      – CORE_PEER_ID=cli
      – CORE_PEER_ADDRESS=peer1-org2:7051
      – CORE_PEER_LOCALMSPID=org2MSP
      – CORE_PEER_TLS_ENABLED=true
      – CORE_PEER_TLS_ROOTCERT_FILE=/tmp/hyperledger/org2/peer1/tls-msp/tlscacerts/tls-0-0-0-0-7052.pem
      – CORE_PEER_MSPCONFIGPATH=/tmp/hyperledger/org2/admin/msp
   working_dir: /opt/gopath/src/github.com/hyperledger/fabric/org2
   command: sh
   volumes:
      – /tmp/hyperledger/org2/peer1:/tmp/hyperledger/org2/peer1
      – /tmp/hyperledger/org2/peer2:/tmp/hyperledger/org2/peer2
      – /Users/kctam/hf142/fabric-samples/chaincode:/opt/gopath/src/github.com/hyperledger/fabric-samples/chaincode
      – /tmp/hyperledger/org2/admin:/tmp/hyperledger/org2/admin
   networks:
      – fabric-ca

docker-compose.yaml

这是用于生成通道工件的配置(configtx.yaml)。

################################################################################
#
#   Section: Organizations
#
#   – This section defines the different organizational identities which will
#   be referenced later in the configuration.
#
################################################################################
Organizations:

  – &org0

    Name: org0

    # ID to load the MSP definition as
    ID: org0MSP

    # MSPDir is the filesystem path which contains the MSP configuration
    MSPDir: /tmp/hyperledger/org0/msp

  – &org1

    Name: org1

    # ID to load the MSP definition as
    ID: org1MSP

    # MSPDir is the filesystem path which contains the MSP configuration
    MSPDir: /tmp/hyperledger/org1/msp

    AnchorPeers:
        # AnchorPeers defines the location of peers which can be used
        # for cross org gossip communication.  Note, this value is only
        # encoded in the genesis block in the Application section context
        – Host: peer1-org1
          Port: 7051

  – &org2

    Name: org2

    # ID to load the MSP definition as
    ID: org2MSP

    # MSPDir is the filesystem path which contains the MSP configuration
    MSPDir: /tmp/hyperledger/org2/msp

    AnchorPeers:
        # AnchorPeers defines the location of peers which can be used
        # for cross org gossip communication.  Note, this value is only
        # encoded in the genesis block in the Application section context
        – Host: peer1-org2
          Port: 7051

################################################################################
#
#   SECTION: Application
#
#   This section defines the values to encode into a config transaction or
#   genesis block for application related parameters
#
################################################################################
Application: &ApplicationDefaults

   # Organizations is the list of orgs which are defined as participants on
   # the application side of the network
   Organizations:

################################################################################
#
#   Profile
#
#   – Different configuration profiles may be encoded here to be specified
#   as parameters to the configtxgen tool
#
################################################################################
Profiles:

  OrgsOrdererGenesis:
    Orderer:
        # Orderer Type: The orderer implementation to start
        # Available types are “solo” and “kafka”
      OrdererType: solo
      Addresses:
      – orderer1-org0:7050

      # Batch Timeout: The amount of time to wait before creating a batch
      BatchTimeout: 2s

      # Batch Size: Controls the number of messages batched into a block
      BatchSize:

        # Max Message Count: The maximum number of messages to permit in a batch
        MaxMessageCount: 10

        # Absolute Max Bytes: The absolute maximum number of bytes allowed for
        # the serialized messages in a batch.
        AbsoluteMaxBytes: 99 MB

        # Preferred Max Bytes: The preferred maximum number of bytes allowed for
        # the serialized messages in a batch. A message larger than the preferred
        # max bytes will result in a batch larger than preferred max bytes.
        PreferredMaxBytes: 512 KB

        # Kafka:
        #   # Brokers: A list of Kafka brokers to which the orderer connects
        #   # NOTE: Use IP:port notation
关键词: Hyperledger  Hyperledger Fabric  

该内容来自于互联网公开内容,非区块链原创内容,如若转载,请注明出处:https://htzkw.com/archives/28779

联系我们

aliyinhang@gmail.com