创建证书并在分类帐中替换它们后无法理解发生了什么问题

Question

我一直在尝试在 hyperledger fabric 1.3 fabcar 示例中使用由 openssl 生成的自定义证书，它使用 1 个有序和 1 个对等（1 个组织）的基本网络。 我已经生成了所需的所有证书并替换了它们，但我一直收到错误消息。

我之前曾问过一个问题（ 是否可以在 Hyperledger Fabrics 中使用第三方 CA 进行生产阶段），根据答案，我已经尝试这样做，但无法跟进并以所有错误和混乱结束。

basic-network docker logs ca.example.com -f      
2019/09/05 11:06:22 [INFO] Created default configuration file at /etc/hyperledger/fabric-ca-server/fabric-ca-server-config.yaml
2019/09/05 11:06:22 [INFO] Starting server in home directory: /etc/hyperledger/fabric-ca-server
2019/09/05 11:06:22 [INFO] Server Version: 1.3.0
2019/09/05 11:06:22 [INFO] Server Levels: &{Identity:1 Affiliation:1 Certificate:1 Credential:1 RAInfo:1 Nonce:1}
2019/09/05 11:06:22 [INFO] The CA key and certificate files already exist
2019/09/05 11:06:22 [INFO] Key file location: /etc/hyperledger/fabric-ca-server-config/4239aa0dcd76daeeb8ba0cda701851d14504d31aad1b2ddddbac6a57365e497c_sk
2019/09/05 11:06:22 [INFO] Certificate file location: /etc/hyperledger/fabric-ca-server-config/ca.org1.example.com-cert.pem
2019/09/05 11:06:26 [INFO] Initialized sqlite3 database at /etc/hyperledger/fabric-ca-server/fabric-ca-server.db
2019/09/05 11:06:26 [INFO] The issuer key was successfully stored. The public key is at: /etc/hyperledger/fabric-ca-server/IssuerPublicKey, secret key is at: /etc/hyperledger/fabric-ca-server/msp/keystore/IssuerSecretKey
2019/09/05 11:06:26 [INFO] Idemix issuer revocation public and secret keys were generated for CA 'ca.example.com'
2019/09/05 11:06:26 [INFO] The revocation key was successfully stored. The public key is at: /etc/hyperledger/fabric-ca-server/IssuerRevocationPublicKey, private key is at: /etc/hyperledger/fabric-ca-server/msp/keystore/IssuerRevocationPrivateKey
2019/09/05 11:06:26 [INFO] Home directory for default CA: /etc/hyperledger/fabric-ca-server
2019/09/05 11:06:26 [INFO] Listening on http://0.0.0.0:7054
2019/09/05 11:07:54 [INFO] 172.25.0.1:55868 POST /api/v1/register 401 26 "Untrusted certificate: Failed to verify certificate: x509: certificate signed by unknown authority"

docker logs orderer.example.com  -f
2019-09-05 11:06:22.521 UTC [localconfig] completeInitialization -> INFO 001 Kafka.Version unset, setting to 0.10.2.0
2019-09-05 11:06:22.582 UTC [orderer/common/server] prettyPrintStruct -> INFO 002 Orderer config values:
    General.LedgerType = "file"
    General.ListenAddress = "0.0.0.0"
    General.ListenPort = 7050
    General.TLS.Enabled = false
    General.TLS.PrivateKey = "/etc/hyperledger/fabric/tls/server.key"
    General.TLS.Certificate = "/etc/hyperledger/fabric/tls/server.crt"
    General.TLS.RootCAs = [/etc/hyperledger/fabric/tls/ca.crt]
    General.TLS.ClientAuthRequired = false
    General.TLS.ClientRootCAs = []
    General.Keepalive.ServerMinInterval = 1m0s
    General.Keepalive.ServerInterval = 2h0m0s
    General.Keepalive.ServerTimeout = 20s
    General.GenesisMethod = "file"
    General.GenesisProfile = "SampleInsecureSolo"
    General.SystemChannel = "test-system-channel-name"
    General.GenesisFile = "/etc/hyperledger/configtx/genesis.block"
    General.Profile.Enabled = false
    General.Profile.Address = "0.0.0.0:6060"
    General.LogLevel = "info"
    General.LogFormat = "%{color}%{time:2006-01-02 15:04:05.000 MST} [%{module}] %{shortfunc} -> %{level:.4s} %{id:03x}%{color:reset} %{message}"
    General.LocalMSPDir = "/etc/hyperledger/msp/orderer/msp"
    General.LocalMSPID = "OrdererMSP"
    General.BCCSP.ProviderName = "SW"
    General.BCCSP.SwOpts.SecLevel = 256
    General.BCCSP.SwOpts.HashFamily = "SHA2"
    General.BCCSP.SwOpts.Ephemeral = false
    General.BCCSP.SwOpts.FileKeystore.KeyStorePath = "/etc/hyperledger/msp/orderer/msp/keystore"
    General.BCCSP.SwOpts.DummyKeystore =
    General.BCCSP.PluginOpts =
    General.Authentication.TimeWindow = 15m0s
    FileLedger.Location = "/var/hyperledger/production/orderer"
    FileLedger.Prefix = "hyperledger-fabric-ordererledger"
    RAMLedger.HistorySize = 1000
    Kafka.Retry.ShortInterval = 5s
    Kafka.Retry.ShortTotal = 10m0s
    Kafka.Retry.LongInterval = 5m0s
    Kafka.Retry.LongTotal = 12h0m0s
    Kafka.Retry.NetworkTimeouts.DialTimeout = 10s
    Kafka.Retry.NetworkTimeouts.ReadTimeout = 10s
    Kafka.Retry.NetworkTimeouts.WriteTimeout = 10s
    Kafka.Retry.Metadata.RetryMax = 3
    Kafka.Retry.Metadata.RetryBackoff = 250ms
    Kafka.Retry.Producer.RetryMax = 3
    Kafka.Retry.Producer.RetryBackoff = 100ms
    Kafka.Retry.Consumer.RetryBackoff = 2s
    Kafka.Verbose = false
    Kafka.Version = 0.10.2.0
    Kafka.TLS.Enabled = false
    Kafka.TLS.PrivateKey = ""
    Kafka.TLS.Certificate = ""
    Kafka.TLS.RootCAs = []
    Kafka.TLS.ClientAuthRequired = false
    Kafka.TLS.ClientRootCAs = []
    Kafka.SASLPlain.Enabled = false
    Kafka.SASLPlain.User = ""
    Kafka.SASLPlain.Password = ""
    Kafka.Topic.ReplicationFactor = 3
    Debug.BroadcastTraceDir = ""
    Debug.DeliverTraceDir = ""
2019-09-05 11:06:22.679 UTC [fsblkstorage] newBlockfileMgr -> INFO 003 Getting block information from block storage
2019-09-05 11:06:22.758 UTC [orderer/common/multichannel] NewRegistrar -> INFO 004 Starting system channel 'testchainid' with genesis block hash bec6cc0cd2f12e6a00c0973252dc28f9eb39eca089d970f5fdbd21238c89b316 and orderer type solo
2019-09-05 11:06:22.758 UTC [orderer/common/server] Start -> INFO 005 Starting orderer:
 Version: 1.3.0
 Commit SHA: ab0a67a
 Go version: go1.10.4
 OS/Arch: linux/amd64
 Experimental features: false
2019-09-05 11:06:22.758 UTC [orderer/common/server] Start -> INFO 006 Beginning to serve requests
2019-09-05 11:06:35.414 UTC [cauthdsl] deduplicate -> ERRO 007 Principal deserialization failure (the supplied identity is not valid: x509: certificate signed by unknown authority) for identity 0a074f7267314d5350129c052d2d2d2d2d424547494e2043455254494649434154452d2d2d2d2d0a4d4949427754434341576567417749424167494a414c654c4d58514f6a544a6a4d416f4743437147534d343942414d434d474578437a414a42674e56424159540a416d6c754d517377435159445651514944414a30637a454d4d416f47413155454277774461486c6b4d526b77467759445651514b44424276636d63784c6d56340a5957317762475575593239744d527777476759445651514444424e6a59533576636d63784c6d56345957317762475575593239744d423458445445354d446b770a4e5445784d4451774d566f58445449354d446b774d6a45784d4451774d566f775354454c4d416b474131554542684d4361573478437a414a42674e564241674d0a416e527a4d517777436759445651514844414e6f65575178487a416442674e5642414d4d466b466b62576c75514739795a7a45755a586868625842735a53356a0a623230775754415442676371686b6a4f5051494242676771686b6a4f50514d4242774e43414151396378754f786e76424b5142586b7a455a464b3848476b69570a3269636a2b454b547552793671586964434c4b42452f446c6f74414e4e686939564a6152704b527479624c3035477958484b5946682b664b484267336f7941770a486a414d42674e5648524d4241663845416a41414d41344741315564447745422f775145417749486744414b42676771686b6a4f5051514441674e49414442460a416945416a2f2b7a522b51687656484d4247347a2f6d674666484a762b494f3443756e5344657574745337394648774349464b64384d645332535733383556630a634d56344e53564259686e41665971652f446334394e66773363376a0a2d2d2d2d2d454e442043455254494649434154452d2d2d2d2d0a
2019-09-05 11:06:35.415 UTC [orderer/common/broadcast] Handle -> WARN 008 [channel: mychannel] Rejecting broadcast of config message from 172.25.0.5:53792 because of error: error authorizing update: error validating DeltaSet: policy for [Group]  /Channel/Application not satisfied: Failed to reach implicit threshold of 1 sub-policies, required 1 remaining
2019-09-05 11:06:35.437 UTC [common/deliver] Handle -> WARN 009 Error reading from 172.25.0.5:53791: rpc error: code = Canceled desc = context canceled

➜  basic-network docker logs peer0.org1.example.com -f
2019-09-05 11:06:25.056 UTC [nodeCmd] serve -> INFO 001 Starting peer:
 Version: 1.3.0
 Commit SHA: ab0a67a
 Go version: go1.10.4
 OS/Arch: linux/amd64
 Experimental features: false
 Chaincode:
  Base Image Version: 0.4.13
  Base Docker Namespace: hyperledger
  Base Docker Label: org.hyperledger.fabric
  Docker Namespace: hyperledger
2019-09-05 11:06:25.056 UTC [ledgermgmt] initialize -> INFO 002 Initializing ledger mgmt
2019-09-05 11:06:25.056 UTC [kvledger] NewProvider -> INFO 003 Initializing ledger provider
2019-09-05 11:06:26.133 UTC [couchdb] CreateDatabaseIfNotExist -> INFO 004 Created state database _users
2019-09-05 11:06:26.365 UTC [couchdb] CreateDatabaseIfNotExist -> INFO 005 Created state database _replicator
2019-09-05 11:06:26.482 UTC [kvledger] NewProvider -> INFO 006 ledger provider Initialized
2019-09-05 11:06:26.551 UTC [ledgermgmt] initialize -> INFO 007 ledger mgmt initialized
2019-09-05 11:06:26.551 UTC [peer] func1 -> INFO 008 Auto-detected peer address: 172.25.0.5:7051
2019-09-05 11:06:26.551 UTC [peer] func1 -> INFO 009 Returning peer0.org1.example.com:7051
2019-09-05 11:06:26.551 UTC [peer] func1 -> INFO 00a Auto-detected peer address: 172.25.0.5:7051
2019-09-05 11:06:26.552 UTC [peer] func1 -> INFO 00b Returning peer0.org1.example.com:7051
2019-09-05 11:06:26.555 UTC [nodeCmd] computeChaincodeEndpoint -> INFO 00c Entering computeChaincodeEndpoint with peerHostname: peer0.org1.example.com
2019-09-05 11:06:26.555 UTC [nodeCmd] computeChaincodeEndpoint -> INFO 00d Exit with ccEndpoint: peer0.org1.example.com:7052
2019-09-05 11:06:26.555 UTC [nodeCmd] createChaincodeServer -> WARN 00e peer.chaincodeListenAddress is not set, using peer0.org1.example.com:7052
2019-09-05 11:06:26.558 UTC [sccapi] registerSysCC -> INFO 00f system chaincode lscc(github.com/hyperledger/fabric/core/scc/lscc) registered
2019-09-05 11:06:26.558 UTC [sccapi] registerSysCC -> INFO 010 system chaincode cscc(github.com/hyperledger/fabric/core/scc/cscc) registered
2019-09-05 11:06:26.558 UTC [sccapi] registerSysCC -> INFO 011 system chaincode qscc(github.com/hyperledger/fabric/core/scc/qscc) registered
2019-09-05 11:06:26.558 UTC [sccapi] registerSysCC -> INFO 012 system chaincode +lifecycle(github.com/hyperledger/fabric/core/chaincode/lifecycle) registered
2019-09-05 11:06:26.562 UTC [gossip/service] func1 -> INFO 013 Initialize gossip with endpoint peer0.org1.example.com:7051 and bootstrap set [127.0.0.1:7051]
2019-09-05 11:06:26.569 UTC [gossip/gossip] NewGossipService -> INFO 014 Creating gossip service with self membership of { [] [127 244 94 154 101 11 2 121 70 22 20 202 230 54 63 6 156 89 121 36 41 58 233 219 9 12 195 138 101 128 9 142] peer0.org1.example.com:7051 <nil> <nil>}
2019-09-05 11:06:26.570 UTC [gossip/gossip] NewGossipService -> WARN 015 External endpoint is empty, peer will not be accessible outside of its organization
2019-09-05 11:06:26.570 UTC [gossip/gossip] start -> INFO 016 Gossip instance peer0.org1.example.com:7051 started
2019-09-05 11:06:26.570 UTC [sccapi] deploySysCC -> INFO 017 system chaincode lscc/(github.com/hyperledger/fabric/core/scc/lscc) deployed
2019-09-05 11:06:26.571 UTC [cscc] Init -> INFO 018 Init CSCC
2019-09-05 11:06:26.571 UTC [sccapi] deploySysCC -> INFO 019 system chaincode cscc/(github.com/hyperledger/fabric/core/scc/cscc) deployed
2019-09-05 11:06:26.571 UTC [qscc] Init -> INFO 01a Init QSCC
2019-09-05 11:06:26.571 UTC [sccapi] deploySysCC -> INFO 01b system chaincode qscc/(github.com/hyperledger/fabric/core/scc/qscc) deployed
2019-09-05 11:06:26.571 UTC [sccapi] deploySysCC -> INFO 01c system chaincode +lifecycle/(github.com/hyperledger/fabric/core/chaincode/lifecycle) deployed
2019-09-05 11:06:26.571 UTC [nodeCmd] serve -> INFO 01d Deployed system chaincodes
2019-09-05 11:06:26.573 UTC [discovery] NewService -> INFO 01e Created with config TLS: false, authCacheMaxSize: 1000, authCachePurgeRatio: 0.750000
2019-09-05 11:06:26.573 UTC [nodeCmd] registerDiscoveryService -> INFO 01f Discovery service activated
2019-09-05 11:06:26.574 UTC [nodeCmd] serve -> INFO 020 Starting peer with ID=[name:"peer0.org1.example.com" ], network ID=[dev], address=[peer0.org1.example.com:7051]
2019-09-05 11:06:26.574 UTC [nodeCmd] serve -> INFO 021 Started peer with ID=[name:"peer0.org1.example.com" ], network ID=[dev], address=[peer0.org1.example.com:7051]
2019-09-05 11:07:25.901 UTC [protoutils] ValidateProposalMessage -> WARN 022 channel [mychannel]: MSP error: channel doesn't exist

openssl x509 -in ca.example.com-cert.pem -text -noout 
Certificate:
    Data:Handle
        Version: 3 (0x2)
        Serial Number: 9451191818837984463 (0x832960e279ea84cf)
    Signature Algorithm: ecdsa-with-SHA256
        Issuer: C=in, ST=ts, L=hyd, O=example.com, CN=ca.example.com
        Validity
            Not Before: Sep  5 10:20:51 2019 GMT
            Not After : Sep  2 10:20:51 2029 GMT
        Subject: C=in, ST=ts, L=hyd, O=example.com, CN=ca.example.com
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub: 
                    04:56:fd:de:01:81:10:29:58:a9:a5:46:96:4f:f7:
                    93:93:9d:57:cf:45:67:d1:b6:ee:bb:7c:3b:9d:df:
                    05:65:1c:c9:57:bc:16:e8:26:0d:36:6d:f6:b2:55:
                    ea:75:62:2f:92:82:9e:2e:4f:e9:49:7c:c7:8e:4c:
                    49:e2:2b:3d:f7
                ASN1 OID: prime256v1
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                CD:F5:6D:31:B1:A7:EE:26:FE:46:31:BA:56:F2:A8:C3:63:98:A3:E1
    Signature Algorithm: ecdsa-with-SHA256
         30:45:02:20:21:10:7d:db:4c:40:5b:33:2d:1f:32:2f:c1:69:
         87:b1:56:ce:d8:30:37:52:4b:3d:57:76:43:e5:4b:76:ad:88:
         02:21:00:fd:b9:33:1b:25:f4:88:a7:93:cf:3d:a9:b7:98:42:
         e1:77:1b:c6:66:0a:72:ac:39:3a:9d:83:e6:0b:7a:4e:1b

admincerts openssl x509 -in Admin@example.com-cert.pem -text -noout 
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 14248524582099573694 (0xc5bced9d91775bbe)
    Signature Algorithm: ecdsa-with-SHA256
        Issuer: C=in, ST=ts, L=hyd, O=example.com, CN=ca.example.com
        Validity
            Not Before: Sep  5 10:29:33 2019 GMT
            Not After : Sep  2 10:29:33 2029 GMT
        Subject: C=in, ST=ts, L=hyd, O=Admin@example.com
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub: 
                    04:e7:a4:3f:55:64:ab:43:6a:f9:3b:46:b3:5e:85:
                    d5:c0:f0:f9:92:82:64:0f:f0:19:1d:89:86:d8:10:
                    d3:14:b0:3f:e8:55:c1:4a:0f:41:d3:14:65:0f:79:
                    f7:9a:73:ed:41:a6:63:76:0b:cf:70:dd:05:32:9e:
                    9c:62:82:f9:d1
                ASN1 OID: prime256v1
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
    Signature Algorithm: ecdsa-with-SHA256
         30:45:02:20:59:41:c0:69:dc:e8:a9:32:1a:11:83:c8:fd:2f:
         cc:71:78:6f:76:8b:ad:d0:36:29:a6:c6:a6:32:23:5a:6e:cd:
         02:21:00:c8:80:aa:14:a2:d3:ea:28:1f:72:37:bb:cb:ac:84:
         c1:95:fb:a2:f0:d8:6f:f3:bb:33:83:bf:68:d4:0c:3c:9f

console log
➜  basic-network ../fabcar/startFabric.sh

# don't rewrite paths for Windows Git Bash users
export MSYS_NO_PATHCONV=1

docker-compose -f docker-compose.yml down
Stopping peer0.org1.example.com ... done
Stopping couchdb                ... done
Stopping ca.example.com         ... done
Stopping orderer.example.com    ... done
Removing peer0.org1.example.com ... done
Removing couchdb                ... done
Removing ca.example.com         ... done
Removing orderer.example.com    ... done
Removing network net_basic

docker-compose -f docker-compose.yml up -d ca.example.com orderer.example.com peer0.org1.example.com couchdb
Creating network "net_basic" with the default driver
Creating ca.example.com      ... done
Creating couchdb             ... done
Creating orderer.example.com ... done
Creating peer0.org1.example.com ... done

# wait for Hyperledger Fabric to start
# incase of errors when running later commands, issue export FABRIC_START_TIMEOUT=<larger number>
export FABRIC_START_TIMEOUT=10
#echo ${FABRIC_START_TIMEOUT}
sleep ${FABRIC_START_TIMEOUT}

# Create the channel
docker exec -e "CORE_PEER_LOCALMSPID=Org1MSP" -e "CORE_PEER_MSPCONFIGPATH=/etc/hyperledger/msp/users/Admin@org1.example.com/msp" peer0.org1.example.com peer channel create -o orderer.example.com:7050 -c mychannel -f /etc/hyperledger/configtx/channel.tx
2019-09-05 11:28:16.837 UTC [channelCmd] InitCmdFactory -> INFO 001 Endorser and orderer connections initialized
Error: got unexpected status: BAD_REQUEST -- error authorizing update: error validating DeltaSet: policy for [Group]  /Channel/Application not satisfied: Failed to reach implicit threshold of 1 sub-policies, required 1 remaining

我正在尝试在 fabcar 示例中使用第三方证书，但无法使用，并且出现上述错误。

configtx.yaml
# Copyright IBM Corp. All Rights Reserved.
#
# SPDX-License-Identifier: Apache-2.0
#

---
################################################################################
#
#   Section: Organizations
#
#   - This section defines the different organizational identities which will
#   be referenced later in the configuration.
#
################################################################################
Organizations:

    # SampleOrg defines an MSP using the sampleconfig.  It should never be used
    # in production but may be used as a template for other definitions
    - &OrdererOrg
        # DefaultOrg defines the organization which is used in the sampleconfig
        # of the fabric.git development environment
        Name: OrdererOrg

        # ID to load the MSP definition as
        ID: OrdererMSP

        # MSPDir is the filesystem path which contains the MSP configuration
        MSPDir: crypto-config/ordererOrganizations/example.com/msp

    - &Org1
        # DefaultOrg defines the organization which is used in the sampleconfig
        # of the fabric.git development environment
        Name: Org1MSP

        # ID to load the MSP definition as
        ID: Org1MSP

        MSPDir: crypto-config/peerOrganizations/org1.example.com/msp

        AnchorPeers:
            # AnchorPeers defines the location of peers which can be used
            # for cross org gossip communication.  Note, this value is only
            # encoded in the genesis block in the Application section context
            - Host: peer0.org1.example.com
              Port: 7051

################################################################################
#
#   SECTION: Application
#
#   - This section defines the values to encode into a config transaction or
#   genesis block for application related parameters
#
################################################################################
Application: &ApplicationDefaults

    # Organizations is the list of orgs which are defined as participants on
    # the application side of the network
    Organizations:

################################################################################
#
#   SECTION: Orderer
#
#   - This section defines the values to encode into a config transaction or
#   genesis block for orderer related parameters
#
################################################################################
Orderer: &OrdererDefaults

    # Orderer Type: The orderer implementation to start
    # Available types are "solo" and "kafka"
    OrdererType: solo

    Addresses:
        - orderer.example.com:7050

    # Batch Timeout: The amount of time to wait before creating a batch
    BatchTimeout: 2s

    # Batch Size: Controls the number of messages batched into a block
    BatchSize:

        # Max Message Count: The maximum number of messages to permit in a batch
        MaxMessageCount: 10

        # Absolute Max Bytes: The absolute maximum number of bytes allowed for
        # the serialized messages in a batch.
        AbsoluteMaxBytes: 99 MB

        # Preferred Max Bytes: The preferred maximum number of bytes allowed for
        # the serialized messages in a batch. A message larger than the preferred
        # max bytes will result in a batch larger than preferred max bytes.
        PreferredMaxBytes: 512 KB

    Kafka:
        # Brokers: A list of Kafka brokers to which the orderer connects
        # NOTE: Use IP:port notation
        Brokers:
            - 127.0.0.1:9092

    # Organizations is the list of orgs which are defined as participants on
    # the orderer side of the network
    Organizations:

################################################################################
#
#   Profile
#
#   - Different configuration profiles may be encoded here to be specified
#   as parameters to the configtxgen tool
#
################################################################################
Profiles:

    OneOrgOrdererGenesis:
        Orderer:
            <<: *OrdererDefaults
            Organizations:
                - *OrdererOrg
        Consortiums:
            SampleConsortium:
                Organizations:
                    - *Org1
    OneOrgChannel:
        Consortium: SampleConsortium
        Application:
            <<: *ApplicationDefaults
            Organizations:
                - *Org1

Answer 1

生成Ca自签名证书

openssl req -x509 -newkey rsa:4096 -days 365 -keyout ca-key.pem -out ca-cert.pem --subj "/C=CA/ST=Ontario/L=TORONTO/O=xdata/OU=iot/CN=iotblock/emailAddress=xys@xdata.com"

查看生成的证书详情

openssl x509 -in ca-cert.pem -noout -text

生成 tls 证书和证书签名请求

openssl req -newkey rsa:4096 -keyout tls-key.pem  -out tls-req.pem --subj "/C=CA/ST=Ontario/L=TORONTO/O=xdata/OU=iot/CN=iotblock/emailAddress=xys@xdata.com"

使用 CA 私钥签署请求

openssl x509 -req -in tls-req.pem -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial -out tls-cert.pem

对于 ecdsa 证书

openssl ecparam -list_curves

openssl ecparam -name sect193r2 -genkey -noout -out ca-key.pem

openssl req -new -sha256 -key ca-key.pem -out ca-cert.csr

Answer 2

终于可以使用使用openssl生成的证书了。 经过大量搜索在一个问题中找到了这个答案并纠正了我的错误， 在 Hyperledger Fabric 中创建对等通道失败我没有清除配置内容 ==> Genisis.json 和用旧加密材料生成的 channeltx。 删除它并再次生成配置后，我能够在自定义加密材料的帮助下成功运行网络。

    ERRO 02d Principal deserialization failure (The supplied identity is not valid, Verify() returned x509: certificate signed by unknown authority) for identity

This would indicate that the certificate claims to be issued by a CA, but is not signed by the CA the orderer knows about (error type 2 above). This would commonly happen if you bootstrapped the orderer, then regenerated the crypto material for your environment without removing the orderer's storage directory.

It's important to remember that the ORDERER_GENERAL_GENESISFILE is only read if the system is not already bootstrapped, so changing the genesis block for the orderer will have no affect unless the orderer storage is also deleted