Взаимная проверка подлинности TLS в Hyperledger Fabric вызывает ошибку Заказчика: «tls: плохой сертификат» - PullRequest
Новая
       12

Взаимная проверка подлинности TLS в Hyperledger Fabric вызывает ошибку Заказчика: «tls: плохой сертификат»

0 голосов
/ 03 июля 2019

Раздел файла values.yaml, который мы используем для предоставления нашим заказчикам и партнерам: 

orderers:
    # cert/key pair generated by Letsencrypt for a single orderer
    # DNS name (e.g. ord0.network.example.com)
    # ORDERER_GENERAL_TLS_CERTIFICATE & ORDERER_GENERAL_TLS_PRIVATEKEY
    # mounted on /var/hyperledger/tls/server/pair/tls.crt
    # mounted on /var/hyperledger/tls/server/pair/tls.key
    tls: <k8s secret holding both tls.crt and tls.key>

    # ORDERER_GENERAL_TLS_ROOTCAS
    # mounted on /var/hyperledger/tls/server/cert/cert.pem
    tlsRootCert: <k8s holding the letsencrypt x3 cross-signed certificate>

    # ORDERER_GENERAL_TLS_CLIENTROOTCAS
    # same as tlsRootCert
    # mounted on /var/hyperledger/tls/client/cert/cert.pem
    tlsClientRootCert: <k8s holding the letsencrypt x3 cross-signed certificate>

    # cert/key generated by fabric-ca-client enroll for the
    # NON admin identity "ord0"
    # mounted on /var/hyperledger/msp/signcerts
    cert: ord0-idcert
    # mounted on /var/hyperledger/msp/keystore
    key: ord0-idkey

    # also generated by fabric-ca-client enroll for the
    # NON admin identity "ord0"
    # mounted on /var/hyperledger/admin_msp/cacerts/cert.pem
    caCert: ord-ca-cert

Дополнительные переменные среды заказа, относящиеся к взаимной аутентификации TLS: 

ORDERER_GENERAL_TLS_ENABLED=true
ORDERER_GENERAL_TLS_CLIENTAUTHREQUIRED=true

peers:
    # cert/key pair generated by Letsencrypt for a single peer
    # e.g. peer0.org1.network.example.com
    # CORE_PEER_TLS_CERT_FILE & CORE_PEER_TLS_KEY_FILE
    # mounted on /var/hyperledger/tls/server/pair/tls.crt
    # mounted on /var/hyperledger/tls/server/pair/tls.key
    tls: <k8s secret holding both tls.crt and tls.key>

    # CORE_PEER_TLS_ROOTCERT_FILE
    # mounted on /var/hyperledger/tls/server/cert/cert.pem
    tlsRootCert: <k8s holding the letsencrypt x3 cross-signed certificate>

    # CORE_PEER_TLS_CLIENTROOTCAS_FILES
    # same as tlsRootCert
    # mounted on /var/hyperledger/tls/client/cert/cert.pem
    tlsClientRootCert: <k8s holding the letsencrypt x3 cross-signed certificate>

    # CORE_PEER_TLS_CLIENTCERT_FILE & CORE_PEER_TLS_CLIENTKEY_FILE
    # mounted on /var/hyperledger/tls/client/pair/tls.crt
    # mounted on /var/hyperledger/tls/client/pair/tls.key
    tlsClient: <k8s secret holding both tls.crt and tls.key>

    # cert/key generated by fabric-ca-client enroll for the
    # NON admin identity "peer0"
    # mounted on /var/hyperledger/msp/signcerts
    cert: peer0-idcert
    # mounted on /var/hyperledger/msp/keystore
    key: peer0-idkey

    # also generated by fabric-ca-client enroll for the
    # NON admin identity "peer0"
    caCert: peer-ca-cert

Дополнительные переменные среды, связанные с взаимной аутентификацией TLS: 

CORE_PEER_TLS_ENABLED=true
CORE_PEER_TLS_CLIENTAUTHREQUIRED=true

При выдаче команды из POD peer0, которая включает в себя связь с одним заказчиком (а именно ord0), мы получаем ошибку bad certificate:

команда полного подключения к равноправному каналу: 

CORE_PEER_MSPCONFIGPATH=/var/hyperledget/admin_msp \
    peer channel join -o ord0.network.example.com:443 \
    -b /var/hyperledger/mychannel.block \
    --tls \
    --cafile /var/hyperledger/tls/server/cert/cert.pem \
    --certfile /var/hyperledger/tls/server/cert/cert.pem \
    --keyfile /var/hyperledger/tls/client/pair/tls.key  \
    --clientauth

Журнал от заказа: 

2019-07-03 14:04:09.717 UTC [core.comm] ServerHandshake -> ERRO 68c TLS handshake failed with error remote error: tls: bad certificate server=Orderer remoteaddress=10.0.3.97:43398
2019-07-03 14:04:09.717 UTC [grpc] handleRawConn -> DEBU 68d grpc: Server.Serve failed to complete security handshake from "10.0.3.97:43398": remote error: tls: bad certificate
2019-07-03 14:04:10.599 UTC [core.comm] ServerHandshake -> ERRO 68e TLS handshake failed with error remote error: tls: bad certificate server=Orderer remoteaddress=10.0.3.97:43404
2019-07-03 14:04:10.599 UTC [grpc] handleRawConn -> DEBU 68f grpc: Server.Serve failed to complete security handshake from "10.0.3.97:43404": remote error: tls: bad certificate
2019-07-03 14:04:12.274 UTC [core.comm] ServerHandshake -> ERRO 690 TLS handshake failed with error remote error: tls: bad certificate server=Orderer remoteaddress=10.0.3.97:43420

Примечание: 10.0.3.97 - это POD IP входного контроллера.

...