fabric-ca

手动安装

安装编译

git clone http://gerrit.hyperledger.org/r/fabric-ca
cd fabric-ca
make fabric-ca-server
make fabric-ca-client
cd bin
cp * /usr/local/bin/
chmod -R 775 /usr/local/bin/fabric-ca-server
chmod -R 775 /usr/local/bin/fabric-ca-clien
fabric-ca-server version
fabric-ca-client version
//确认版本是否正确

初始化

mkdir fabric-ca-server
cd fabric-ca-server
fabric-ca-server init -b admin:12345678a

启动

./fabric-ca-server start -b  admin:pass &
cd /opt/app/fabric-ca/server
#如果有删除联盟和删除用户的需求，需要用下面的方式启动：
./fabric-ca-server start -b admin:pass --cfg.affiliations.allowremove  --cfg.identities.allowremove &



#[. \w\d()-:";'=<>~*]*
^[ ]*\n+

docker方式

docker启动的服务增加以下配置即可

ca.org1.zhengtoon.com:
        image: hyperledger/fabric-ca:$IMAGE_TAG
        environment:
          - FABRIC_CA_HOME=/etc/hyperledger/fabric-ca-server
          - FABRIC_CA_SERVER_CA_NAME=ca-org1
          - FABRIC_CA_SERVER_CA_CERTFILE=/etc/hyperledger/fabric-ca-server-config/ca.org1.zhengtoon.com-cert.pem
          - FABRIC_CA_SERVER_CA_KEYFILE=/etc/hyperledger/fabric-ca-server-config/c3695bb56bfcaa80555af338e75fc51587e6a42a5b755f8a1d20908371be289e_sk
          - FABRIC_CA_SERVER_TLS_ENABLED=false
          - FABRIC_CA_SERVER_TLS_CERTFILE=/etc/hyperledger/fabric-ca-server-config/ca.org1.zhengtoon.com-cert.pem
          - FABRIC_CA_SERVER_TLS_KEYFILE=/etc/hyperledger/fabric-ca-server-config/c3695bb56bfcaa80555af338e75fc51587e6a42a5b755f8a1d20908371be289e_sk
        ports:
          - "7054:7054"
        command: sh -c 'fabric-ca-server start -b admin:adminpw -d'
        volumes:
          - ./crypto-config/peerOrganizations/org1.zhengtoon.com/ca/:/etc/hyperledger/fabric-ca-server-config
        container_name: ca_peerOrg1
        networks:
          - byfn
    
      ca.org2.zhengtoon.com:
        image: hyperledger/fabric-ca:$IMAGE_TAG
        environment:
          - FABRIC_CA_HOME=/etc/hyperledger/fabric-ca-server
          - FABRIC_CA_SERVER_CA_NAME=ca-org2
          - FABRIC_CA_SERVER_CA_CERTFILE=/etc/hyperledger/fabric-ca-server-config/ca.org2.zhengtoon.com-cert.pem
          - FABRIC_CA_SERVER_CA_KEYFILE=/etc/hyperledger/fabric-ca-server-config/233217b8ac4b11588dd40b5dc7987b8ffd4ef48b00fd7b673dc92f2bcadbe005_sk
          - FABRIC_CA_SERVER_TLS_ENABLED=false
          - FABRIC_CA_SERVER_TLS_CERTFILE=/etc/hyperledger/fabric-ca-server-config/ca.org2.zhengtoon.com-cert.pem
          - FABRIC_CA_SERVER_TLS_KEYFILE=/etc/hyperledger/fabric-ca-server-config/233217b8ac4b11588dd40b5dc7987b8ffd4ef48b00fd7b673dc92f2bcadbe005_sk
        ports:
          - "8054:7054"
        command: sh -c 'fabric-ca-server start -b admin:adminpw -d'
        volumes:
          - ./crypto-config/peerOrganizations/org2.zhengtoon.com/ca/:/etc/hyperledger/fabric-ca-server-config
        container_name: ca_peerOrg2
        networks:
          - byfn

启动之后访问

http://localhost:7054/cainfo

管理员身份认证

export FABRIC_CA_CLIENT_HOME=/Users/qifei/syswin/fabric-deploy/fabric-ca-client
fabric-ca-client enroll -u http://admin:adminpw@localhost:7054

创建联盟

    # 默认会创建两个组织
    fabric-ca-client  affiliation list
    # 移除联盟
    fabric-ca-client  affiliation remove --force  org1
    # 创建联盟
    fabric-ca-client  affiliation add com
    fabric-ca-client  affiliation add com.zhengtoon
    fabric-ca-client  affiliation add com.zhengtoon.org1
    fabric-ca-client  affiliation add com.zhengtoon.org2

为组织准备msp

#准备ca文件
mkdir -p ./zhengtoon.com/msp
fabric-ca-client getcacert -M ./zhengtoon.com/msp
mkdir -p ./org1.zhengtoon.com/msp
fabric-ca-client getcacert -M ./org1.zhengtoon.com/msp
mkdir -p ./org2.zhengtoon.com/msp
fabric-ca-client getcacert -M ./org2.zhengtoon.com/msp
#tls证书，如果各个组件域名的证书，是由第三方CA签署的，就将第三方CA的根证书添加
cp -rf ../crypto-config/ordererOrganizations/zhengtoon.com/msp/tlscacerts  ./zhengtoon.com/msp/
cp -rf ../crypto-config/peerOrganizations/org1.zhengtoon.com/msp/tlscacerts ./org1.zhengtoon.com/msp/
cp -rf ../crypto-config/peerOrganizations/org2.zhengtoon.com/msp/tlscacerts ./org2.zhengtoon.com/msp/

注册example.com的管理员[email protected]

fabric-ca-client register --id.name [email protected] --id.type client --id.affiliation "com.zhengtoon.org1" --id.attrs '"hf.Registrar.Roles=client,orderer,peer,user","hf.Registrar.DelegateRoles=client,orderer,peer,user",hf.Registrar.Attributes=*,hf.GenCRL=true,hf.Revoker=true,hf.AffiliationMgr=true,hf.IntermediateCA=true,role=admin:ecert'     --id.secret=password

或修改fabric-ca-client-config.yaml

id:
  name: [email protected]
  type: client
  affiliation: com.zhengtoon
  maxenrollments: 0
  attributes:
    - name: hf.Registrar.Roles
      value: client,orderer,peer,user
    - name: hf.Registrar.DelegateRoles
      value: client,orderer,peer,user
    - name: hf.Registrar.Attributes
      value: "*"
    - name: hf.GenCRL
      value: true
    - name: hf.Revoker
      value: true
    - name: hf.AffiliationMgr
      value: true
    - name: hf.IntermediateCA
      value: true
    - name: role
      value: admin
      ecert: true

最后一行role属性，是我们自定义的属性，对于自定义的属性，要设置certs，在配置文件中需要单独设置ecert属性为true或者false。如果在命令行中，添加后缀:ecert表示true。

#admin账号注册，不用--id.secret指定密码，会自动生成密码。
fabric-ca-client register  --id.secret=password

属性对应解释

--id.name  [email protected]                           //用户名
--id.type client                                       //类型为client，能够管理com.example.*下的用户
--id.affiliation "com.example"                         //权利访问
hf.Registrar.Roles=client,orderer,peer,user            //能够管理的用户类型
hf.Registrar.DelegateRoles=client,orderer,peer,user    //可以授权给子用户管理的用户类型
hf.Registrar.Attributes=*                              //可以为子用户设置所有属性
hf.GenCRL=true                                         //可以生成撤销证书列表
hf.Revoker=true                                        //可以撤销用户
hf.AffiliationMgr=true                                 //能够管理联盟
hf.IntermediateCA=true                                 //可以作为中间CA
role=admin:ecert                                       //自定义属性

完成注册

#生成凭证
mkdir -p ./zhengtoon.com/admin
fabric-ca-client enroll -u http://[email protected]:password@localhost:7054  -H ./zhengtoon.com/admin

此时可以使用生成的[email protected]查看联盟

fabric-ca-client affiliation list -H ./zhengtoon.com/admin

此时具备管理员权限

mkdir ./zhengtoon.com/msp/admincerts/
cp ./zhengtoon.com/admin/msp/signcerts/cert.pem  ./zhengtoon.com/msp/admincerts/

注册org1.example.com的管理员[email protected]

 mkdir ./org1.zhengtoon.com/admin

修改fabric-ca-client-config.yaml

id:
  name: [email protected]
  type: client
  affiliation: com.example.org1
  maxenrollments: 0
  attributes:
    - name: hf.Registrar.Roles
      value: client,orderer,peer,user
    - name: hf.Registrar.DelegateRoles
      value: client,orderer,peer,user
    - name: hf.Registrar.Attributes
      value: "*"
    - name: hf.GenCRL
      value: true
    - name: hf.Revoker
      value: true
    - name: hf.AffiliationMgr
      value: true
    - name: hf.IntermediateCA
      value: true
    - name: role
      value: admin
      ecert: true

    #注册
    fabric-ca-client register --id.secret=password
    #生成凭证
    fabric-ca-client enroll -u http://[email protected]:password@localhost:7054  -H ./org1.zhengtoon.com/admin
    #查看联盟
    fabric-ca-client affiliation list -H ./org1.zhengtoon.com/admin
    #通过peer命令操作fabric会要求`admincerts`的存在
    mkdir ./org1.zhengtoon.com/msp/admincerts/
    cp ./org1.zhengtoon.com/admin/msp/signcerts/cert.pem  ./org1.zhengtoon.com/msp/admincerts/
    #没有使用中间CA，将intermediatecerts中的空文件删除，否则peer会提示Warning：
    rm ./org1.zhengtoon.com/admin/msp/intermediatecerts/*

注册org2.example.com的管理员[email protected]

同上，修改yaml，执行命令

fabric-ca-client register --id.secret=password
fabric-ca-client enroll -u http://[email protected]:password@localhost:7054  -H ./org2.zhengtoon.com/admin
fabric-ca-client affiliation list -H ./org2.zhengtoon.com/admin
mkdir ./org2.zhengtoon.com/msp/admincerts/
cp ./org2.zhengtoon.com/admin/msp/signcerts/cert.pem  ./org2.zhengtoon.com/msp/admincerts/
rm ./org2.zhengtoon.com/admin/msp/intermediatecerts/*

各个组织分别使用自己的Admin账户创建其它账号

orderer.example.com

修改fabric-ca-files/example.com/admin/fabric-ca-client-config.yaml:

id:
  name: orderer.example.com
  type: orderer
  affiliation: com.example
  maxenrollments: 0
  attributes:
    - name: role
      value: orderer
      ecert: true

注册以及生成凭证：

fabric-ca-client register -H ./zhengtoon.com/admin --id.secret=password
mkdir ./zhengtoon.com/orderer
fabric-ca-client enroll -u http://orderer.zhengtoon.com:password@localhost:7054 -H ./zhengtoon.com/orderer

将[email protected]的证书复制到fabric-ca-files/example.com/orderer/msp/admincerts：

mkdir ./zhengtoon.com/orderer/msp/admincerts
cp ./zhengtoon.com/admin/msp/signcerts/cert.pem ./zhengtoon.com/orderer/msp/admincerts/

peer0.org1.zhengtoon.com

修改org1.zhengtoon.com/admin/fabric-ca-client-config.yaml

id:
  name: peer0.org1.zhengtoon.com
  type: peer
  affiliation: com.zhengtoon.org1
  maxenrollments: 0
  attributes:
    - name: role
      value: peer
      ecert: true

fabric-ca-client register -H ./org1.zhengtoon.com/admin --id.secret=password
mkdir ./org1.zhengtoon.com/peer0
fabric-ca-client enroll -u http://peer0.org1.zhengtoon.com:password@localhost:7054 -H ./org1.zhengtoon.com/peer0

peer1.org1.zhengtoon.com

id:
  name: peer1.org1.zhengtoon.com
  type: peer
  affiliation: com.zhengtoon.org1
  maxenrollments: 0
  attributes:
    - name: role
      value: peer
      ecert: true

fabric-ca-client register -H ./org1.zhengtoon.com/admin --id.secret=password
mkdir ./org1.zhengtoon.com/peer1
fabric-ca-client enroll -u http://peer1.org1.zhengtoon.com:password@localhost:7054 -H ./org1.zhengtoon.com/peer1

peer0.org2.zhengtoon.com

id:
  name: peer0.org2.zhengtoon.com
  type: peer
  affiliation: com.zhengtoon.org2
  maxenrollments: 0
  attributes:
    - name: role
      value: peer
      ecert: true

fabric-ca-client register -H ./org2.zhengtoon.com/admin --id.secret=password
mkdir ./org2.zhengtoon.com/peer0
fabric-ca-client enroll -u http://peer0.org2.zhengtoon.com:password@localhost:7054 -H ./org2.zhengtoon.com/peer0

peer1.org2.zhengtoon.com

id:
  name: peer1.org2.zhengtoon.com
  type: peer
  affiliation: com.zhengtoon.org2
  maxenrollments: 0
  attributes:
    - name: role
      value: peer
      ecert: true

fabric-ca-client register -H ./org2.zhengtoon.com/admin --id.secret=password
mkdir ./org2.zhengtoon.com/peer1
fabric-ca-client enroll -u http://peer1.org2.zhengtoon.com:password@localhost:7054 -H ./org2.zhengtoon.com/peer1

mkdir ./org1.zhengtoon.com/peer0/msp/admincerts
cp ./org1.zhengtoon.com/admin/msp/signcerts/cert.pem ./org1.zhengtoon.com/peer0/msp/admincerts/
mkdir ./org1.zhengtoon.com/peer1/msp/admincerts
cp ./org1.zhengtoon.com/admin/msp/signcerts/cert.pem ./org1.zhengtoon.com/peer1/msp/admincerts/
mkdir ./org2.zhengtoon.com/peer0/msp/admincerts
cp ./org2.zhengtoon.com/admin/msp/signcerts/cert.pem ./org2.zhengtoon.com/peer0/msp/admincerts/
mkdir ./org2.zhengtoon.com/peer1/msp/admincerts
cp ./org2.zhengtoon.com/admin/msp/signcerts/cert.pem ./org2.zhengtoon.com/peer1/msp/admincerts/

重新部署

修改configtx.yaml中msp路径为fabric-ca创建的msp目录：

Organizations:
    - &OrdererOrg
        Name: OrdererOrg
        ID: OrdererMSP
        MSPDir: ./fabric-ca-client/zhengtoon.com/msp
    - &Org1
        Name: Org1MSP
        ID: Org1MSP
        MSPDir: ./fabric-ca-client/org1.zhengtoon.com/msp
        AnchorPeers:
            - Host: peer0.org1.zhengtoon.com
              Port: 7051
    - &Org2
        Name: Org2MSP
        ID: Org2MSP
        MSPDir: ./fabric-ca-client/org2.zhengtoon.com/msp
        AnchorPeers:
            - Host: peer0.org2.zhengtoon.com
              Port: 7051
Orderer: &OrdererDefaults
    OrdererType: solo
    Addresses:
        - orderer.zhengtoon.com:7050
    BatchTimeout: 2s
    BatchSize:
        MaxMessageCount: 10
        AbsoluteMaxBytes: 99 MB
        PreferredMaxBytes: 512 KB
    Kafka:
        Brokers:
            - 127.0.0.1:9092
    Organizations:
Application: &ApplicationDefaults
    Organizations:
Profiles:
    TwoOrgsOrdererGenesis:
        Orderer:
            <<: *OrdererDefaults
            Organizations:
                - *OrdererOrg
        Consortiums:
            SampleConsortium:
                Organizations:
                    - *Org1
                    - *Org2
    TwoOrgsChannel:
        Consortium: SampleConsortium
        Application:
            <<: *ApplicationDefaults
            Organizations:
                - *Org1
                - *Org2

更新msp

创建证书文件夹：

mkdir orderer.zhengtoon.com
mkdir peer0.org1.zhengtoon.com
mkdir peer0.org2.zhengtoon.com
mkdir peer1.org2.zhengtoon.com
mkdir peer1.org1.zhengtoon.com

拷贝ca生成的证书

cp -r fabric-ca-client/zhengtoon.com/orderer/msp orderer.zhengtoon.com/
cp -r fabric-ca-client/org1.zhengtoon.com/peer0/msp peer0.org1.zhengtoon.com/
cp -r fabric-ca-client/org1.zhengtoon.com/peer1/msp peer1.org1.zhengtoon.com/
cp -r fabric-ca-client/org2.zhengtoon.com/peer0/msp peer0.org2.zhengtoon.com/
cp -r fabric-ca-client/org2.zhengtoon.com/peer1/msp peer1.org2.zhengtoon.com/

修改docker-compse msp以及创世块映射
清除/var/hyperledger/production 对应的文件夹

重新生成创世块

mkdir channel-artifacts-ca
configtxgen -profile TwoOrgsOrdererGenesis -outputBlock ./channel-artifacts-ca/genesis.block

#查看创世块内容

configtxgen  -inspectBlock ./channel-artifacts-ca/genesis.block

重新启动所有服务

重新创建channel等