Fabric-CA根服务器和中间服务器

Question

In reference to this article HYPERLEDGER FABRIC CERTIFICATE AUTHORITY(CA) , I am trying to understand the relationship between the Fabric-CA Root server and the Fabric-CA Intermediate server. Is it correct to say that, in the entire article, what has been discussed is – How to setup an “Intermediate” server? If so, where is the Root server located? How does the Intermediate server discover / communicate with the Root server?

[Diagram from the article] [ ] 2

Answer 1

First and foremost I would suggest you to refer to the Fabric Official documentation : http://hyperledger-fabric-ca.readthedocs.io/en/latest/users-guide.html#overview

Any changes and corrections would be always reflected to the official documentation.

The entire article has been explained on how to setup a Hyperledger Fabric CA Server cluster. (Ref: Difference between Fabric CA server and CA Client ) If you look at the diagram closely, you would be able to recognize that there is indeed a Root CA server. The reason the root CA is kept aside is because of security reasons. In case the root CA server/Root of Trust is compromised, the entire network will be compromised. Protecting the root of trust is of utmost importance in PKI and this is a standard practice of setting up a PKI (Public Key Infrastructure)

The role of one or more intermediate CA servers is to act as Certification Authorities to register, issue E-Certs/T-Certs, renewal and revocation of certs on behalf of the root CA having the same root of trust.

The diagram shows a cluster of Intermediate CA servers in Highly Available configuration using HA-Proxy coupled with a relational database (you can again opt for using a HA cluster of your database) to store all the user information.

You can enroll an intermediate CA server just like you would do for normal users (peer/app) :

fabric-ca-server start -b admin:adminpw -u http://<enrollmentID>:<secret>@<parentserver>:<parentport>

For more reference you can refer : http://hyperledger-fabric-ca.readthedocs.io/en/latest/users-guide.html#enrolling-an-intermediate-ca