fabric-ca

一 .fabric-ca載入openssl生成的ecdsa標準證書

1. 生成橢圓加密根證書步驟

• 生成私鑰

openssl ecparam -name prime256v1 -genkey -out ca-key_.pem

• 私鑰轉換成pk8格式

openssl pkcs8 -inform PEM -outform PEM -topk8 -nocrypt -in ca-key_.pem -out ca-key.pem

• 建立生成證書請求

openssl req -config openssl.cnf -new -key ca-key.pem -out cert-req.csr

openssl.conf內容見(1)

• 生成自簽名證書

openssl x509 -req   -extfile /usr/lib/ssl/openssl.cnf -extensions usr_cert  -in cert-req.csr -out ca-cert.pem -signkey ca-key.pem  -CAcreateserial -days 3650

2. 檢視

• 檢視cert-req.csr

openssl req -in cert-req.csr -text

• 檢視ca-cert.pem

openssl x509 -in ca-cert.pem -text -noout

3. 載入ca-cert.pem證書,開啟ca服務.

• 匯入ca-cert.pem證書和ca-key.pem祕鑰

mv ca-cert.pem ca-key.pem $GOPATH/src/github.com/hyperledger/fabric-ca/docker/server/fabric-ca-server

• 開啟ca服務

cd $GOPATH/src/github.com/hyperledger/fabric-ca/docker/server/
docker-compose up

• 客戶端申請證書

fabric-ca-client enroll -u http://admin:adminpw@localhost:7054

4. 參考

• markdown語法

• How to generate x509v3 Extensions in the End user certificate

• openssl生成SSL證書的流程

---

****************** 華麗的分割線 ******************

---

(1)openssl.conf

[ req ]
default_md              = sha256
default_keyfile         = ca-key.pem
distinguished_name      = req_distinguished_name
prompt = no
x509_extensions = v3_ca
req_extensions  = v3_req
x509_extensions = usr_cert
[ req_distinguished_name ]
C=US
ST=North Carolina
L=Raleigh
O=Example
CN=Example.com
[ usr_cert ]
basicConstraints=critical,CA:true,pathlen:1
keyUsage=critical, keyCertSign,cRLSign
subjectKeyIdentifier=hash
[ v3_req ]
basicConstraints=critical,CA:true,pathlen:1
keyUsage=critical, keyCertSign,cRLSign
subjectKeyIdentifier=hash

二.fabric-ca連線mysql

資料庫版本必須是MySQL 5.7.X,

1. 配置yml檔案

db:
  type: mysql
  datasource: root:rootpw@tcp(localhost:3306)/fabric_ca?parseTime=true&tls=custom
  tls:
      enabled: true
      certfiles:
        - db-server-cert.pem
      client:
            certfile: db-client-cert.pem
            keyfile: db-client-key.pem

2. 配置mysqlserver my.cnf

[mysqld] ssl-ca=ca-cert.pem ssl-cert=server-cert.pem ssl-key=server-key.pem

3. 查詢ssl是否可用

# have_openssl have_ssl 
mysql> SHOW GLOBAL VARIABLES LIKE ‘have_%ssl’;

如果看見下面就ok了

Variable_name	Value
have_openssl	YES
have_ssl	YES

4.建立使用者

mysql> GRANT ALL PRIVILEGES ON . TO ‘ssluser’@’%’ IDENTIFIED BY ‘password’ REQUIRE SSL; mysql> FLUSH PRIVILEGES;