本机运行 Fabric CA - 找不到默认的“PKCS11”BCCSP

Question

Attempting to configure HSM according to: https://hyperledger-fabric-ca.readthedocs.io/en/release-1.4/users-guide.html#configuring-an-hsm

but trying to do so running the Fabric CA Server as a systemd service according to: https://upcloud.com/community/tutorials/hyperledger-fabric-systemd/

I followed a combo of the above link and this link: https://gist.github.com/AkshayCHD/f7c96175dca1e5ab8d5785a3af0d5692

BUT I built it with "GO_TAGS=pkcs11 make fabric-ca-server" according to this: https://jira.hyperledger.org/browse/FAB-13458

I installed SoftHSM according to the below link and can initialize the token: https://wiki.opendnssec.org/display/SoftHSMDOCS/SoftHSM+Documentation+v2#SoftHSMDocumentationv2-Download

I initialize the server before starting so I can edit the fabric-ca-server-config.yaml with the appropriate PKCS11 data.

I can start the server/service fine without PKCS11 but when I edit the fabric-ca-server-config.yaml file to the below it never works.

INTERESTINGLY when I switch the default to "SW" I receive: Error: Failed to initialize BCCSP Factories: Failed initializing PKCS11.BCCSP %!s(): Could not initialize BCCSP PKCS11 [Failed initializing PKCS11 library /home/ubuntu/softhsm/SoftHSMv2/src/lib/.libs/libsofthsm2.so ForFabric: Could not get Slot List [pkcs11: 0x190: CKR_CRYPTOKI_NOT_INITIALIZED]]

BUT when I have "default: PKCS11" I get this error: Could not find default PKCS11 BCCSP

I have read this https://jira.hyperledger.org/browse/FAB-9595 but AGAIN I'm not using Docker.

Any help or pointers in the right direction would be appreciated.

Relevant output:

bccsp: default: PKCS11
pkcs11:
Library: /home/ubuntu/softhsm/SoftHSMv2/src/lib/.libs/libsofthsm2.so
Pin: 98765432
Label: ForFabric
hash: SHA2
security: 256
filekeystore:
# The directory used for the software file-based keystore
keystore: msp/keystore
sw:
hash: SHA2
security: 256
filekeystore:
# The directory used for the software file-based keystore
keystore: msp/keystore

fabric-ca-server:

Version: 2.0.0-snapshot-d780eb0

Go version: go1.13.5

OS/Arch: linux/amd64

Answer 1

执行GO_TAGS=pkcs11 make fabric-ca-server ，记得把原来的fabric-ca-server 二进制文件去掉，把新建的二进制文件放到path/to/go/bin

Answer 2

The issue encountered was a combination of creating the tokens as one user and starting the service as another (sudo). Creating the token and starting the Fabric CA server as root (sudo -i) solved this issue.

root@ip-172-31-85-208:~/fab-ca/server# fabric-ca-server start -b admin:adminpw 2020/01/10 17:57:31 [INFO] Configuration file location: /root/fab-ca/server/fabric-ca-server-config.yaml 2020/01/10 17:57:31 [INFO] Starting server in home directory: /root/fab-ca/server 2020/01/10 17:57:31 [INFO] Server Version: 2.0.0-snapshot-d780eb0 2020/01/10 17:57:31 [INFO] Server Levels: &{Identity:2 Affiliation:1 Certificate:1 Credential:1 RAInfo:1 Nonce:1} 2020/01/10 17:57:31 [INFO] The CA key and certificate already exist 2020/01/10 17:57:31 [INFO] The key is stored by BCCSP provider 'PKCS11' 2020/01/10 17:57:31 [INFO] The certificate is at: /root/fab-ca/server/ca-cert.pem 2020/01/10 17:57:31 [INFO] Initialized sqlite3 database at /root/fab-ca/server/fabric-ca-server.db 2020/01/10 17:57:31 [INFO] The Idemix issuer public and secret key files already exist 2020/01/10 17:57:31 [INFO] secret key file location: /root/fab-ca/server/msp/keystore/IssuerSecretKey 2020/01/10 17:57:31 [INFO] public key file l ocation: /root/fab-ca/server/IssuerPublicKey 2020/01/10 17:57:31 [INFO] The Idemix issuer revocation public and secret key files already exist 2020/01/10 17:57:31 [INFO] private key file location: /root/fab-ca/server/msp/keystore/IssuerRevocationPrivateKey 2020/01/10 17:57:31 [INFO] public key file location: /root/fab-ca/server/IssuerRevocationPublicKey 2020/01/10 17:57:31 [INFO] Home directory for default CA: /root/fab-ca/server 2020/01/10 17:57:31 [INFO] Operation Server Listening on 127.0.0.1:9443 2020/01/10 17:57:31 [INFO] Listening on http://0.0.0.0:7054