Hyperledger Fabric 1.0 快速搭建 -------- 多机部署 Fabric CA节点服务

我不是女神ヾ 2022-05-09 03:48 245阅读 0赞

## **前言** ##

在这里我推荐两位大神的博客，可以参考或者直接跟着这两位大神学习，我是阅读这两位大神的博客和《深度探索区块链Hyperledger技术与应用》一书部署的

《深度探索区块链Hyperledger技术与应用》作者：张增骏、董宁、朱轩彤、陈剑雄  著。

深蓝大大：[https://www.cnblogs.com/studyzy/category/1024666.html][https_www.cnblogs.com_studyzy_category_1024666.html]

Aberic大神：[https://www.cnblogs.com/aberic/category/1148898.html][https_www.cnblogs.com_aberic_category_1148898.html]

Fabric CA服务是官方提供的数字证书管理的一个默认实现，Fabric CA是超级账本的数字证书认证中心，提供了以下功能：

用户信息的注册；

数字证书的发行；

数字证书的延期与吊销

Fabric CA 服务端提供用户登记和注册数字证书管理功能，数据存储后端可以是Mysql、PostgreSQL、LDAP等，如果配置了LDAP，用户信息存在于LDAP中，而不是存放在Mysql或者PostgreSQL，通过数据存储和业务逻辑的分离，Fabric CA服务能够采用无状态的集群部署。通过HAProxy等软件实现负载均衡功能，实现服务的高可用。

图片来自官网，阐述了Fabric CA在整个超级账本中的作用

![70][]

有人说CA就是MSP的具体实现，之前用户的MSP证书是通过平台特定二进制文件来生成的，现在我们是通过访问CA服务来实现证书的发行，和用户的注册。CA服务还提供了数字证书的延期和吊销。

而能给别人发放证书的有两种，一种是根证书（root），一种是tls根证书，被这两种根证书发行的证书叫做 ”中间CA证书“ 发行的证书有私钥和公钥（cert证书，我这样写不严谨，只是我自己理解的，希望不要误导）。

所以这次我部署了两个CA服务，一个放的是tlsCA根证书，一个是CA根证书，tlsCA服务可以不用部署，视情况可定，我需要所以部署了。TlsCA和CA的部署顺序与配置是大部分一样的，没有本质上的区别，都是CA服务器，只是证书文件(ca-cert.pem,ca-key.pem)用的不一样，tlsCA服务器用的是tls根证书，CA服务器用的是CA根证书，把这两个分清楚就可以了，这两个CA节点分别在不同的服务器节点上部署即可。

关于CA更详细的可以参考官网文档：[https://hyperledger-fabric-ca.readthedocs.io/en/latest/][https_hyperledger-fabric-ca.readthedocs.io_en_latest]

还有一个博文应该是根据官网写的笔记：[https://blog.csdn.net/baidu\_39649815/article/details/76259031][https_blog.csdn.net_baidu_39649815_article_details_76259031]

## **开始** ##

**1.配置文件与证书文件**

CA服务在node6机器上进行操作

1.1因为我们选择使用的是PostgreSQL数据库来存储，所以在启动CA之前一定要先启动数据库容器

[root@node6 ~]# mkdir -p /u01/data/postgresql
    
    [root@node6 ~]# docker run --name mypostgres1 -e POSTGRES_PASSWORD=postgres -e POSTGRES_USER=postgres -p 5432:5432 -v /u01/data/postgresql:/var/lib/postgresql/data -d postgres -c 'shared_buffers=256MB' -c 'max_connections=500'

1.2.配置CA 服务fabric-ca-server-config.yaml文件 这个文件会在启动CA容器的时候默认在你映射的目录下寻找，如果没有这个文件，CA服务会自动生成一个，设置什么的都是默认的，在这里我们手动创建一个fabric-ca-server-config.yaml

[root@node6 ~]# mkdir -p /u01/ca
    
    [root@node6 ~]# cd -p /u01/ca
    
    [root@node6 ~]# vi fabric-ca-server-config.yaml
    
    #
    #   COMMAND LINE ARGUMENTS AND ENVIRONMENT VARIABLES
    #   ------------------------------------------------
    #   Each configuration element can be overridden via command line
    #   arguments or environment variables.  The precedence for determining
    #   the value of each element is as follows:
    #   1) command line argument
    #      Examples:
    #      a) --port 443
    #         To set the listening port
    #      b) --ca-keyfile ../mykey.pem
    #         To set the "keyfile" element in the "ca" section below;
    #         note the '-' separator character.
    #   2) environment variable
    #      Examples:
    #      a) FABRIC_CA_SERVER_PORT=443
    #         To set the listening port
    #      b) FABRIC_CA_SERVER_CA_KEYFILE="../mykey.pem"
    #         To set the "keyfile" element in the "ca" section below;
    #         note the '_' separator character.
    #   3) configuration file
    #   4) default value (if there is one)
    #      All default values are shown beside each element below.
    #
    #   FILE NAME ELEMENTS
    #   ------------------
    #   The value of all fields whose name ends with "file" or "files" are
    #   name or names of other files.
    #   For example, see "tls.certfile" and "tls.clientauth.certfiles".
    #   The value of each of these fields can be a simple filename, a
    #   relative path, or an absolute path.  If the value is not an
    #   absolute path, it is interpretted as being relative to the location
    #   of this configuration file.
    #
    #############################################################################
    
    # Server's listening port (default: 7054)  默认的端口
    port: 7054
    
    # Enables debug logging (default: false)  
    # 日志的级别默认是false不开启 开启后会有更多的信息打印在控制台
    debug: true
    
    # Size limit of an acceptable CRL in bytes (default: 512000)
    crlsizelimit: 512000
    
    #############################################################################
    #  TLS section for the server's listening port
    #
    #  The following types are supported for client authentication: NoClientCert,
    #  RequestClientCert, RequireAnyClientCert, VerifyClientCertIfGiven,
    #  and RequireAndVerifyClientCert.
    #
    #  Certfiles is a list of root certificate authorities that the server uses
    #  when verifying client certificates.
    #############################################################################
    #是否在服务端启用TLS,如果启用TLS后进行身份验证的证书和签名的私钥
    tls:
      # Enable TLS (default: false)
      enabled: false
      # TLS for the server's listening port
      certfile: server.crt   #如果开启后tls的证书就要把你用的哪个节点的tls证书和私钥放在 /u01/ca下
      keyfile: server.key
      clientauth:
        type: noclientcert
        certfiles: ca.crt
    
    #############################################################################
    #  The CA section contains information related to the Certificate Authority
    #  including the name of the CA, which should be unique for all members
    #  of a blockchain network.  It also includes the key and certificate files
    #  used when issuing enrollment certificates (ECerts) and transaction
    #  certificates (TCerts).
    #  The chainfile (if it exists) contains the certificate chain which
    #  should be trusted for this CA, where the 1st in the chain is always the
    #  root CA certificate.
    #############################################################################
    # 包括实例的名称、签名私钥文件、身份验证证书和证书链文件乖；这些私钥和证书文件会用来作为生成ECert、TCert的根证书
    ca:
      # Name of this CA   CA服务名称. 可以支持多个服务
      name: userca
      # Key file (default: ca-key.pem)  密钥文件(默认: ca-key.pem)
      keyfile: ca-key.pem
      # Certificate file (default: ca-cert.pem)   证书文件(默认: ca-cert.pem)
      certfile: ca-cert.pem
      # Chain file (default: chain-cert.pem)   证书链文件(默认: chain-cert.pem)
      chainfile: ca-chain.pem
    
    #其实上面的证书名字写什么都无所谓，这里写什么,在/u01/ca下的ca证书要跟这里写的一样
    #############################################################################
    #  The registry section controls how the fabric-ca-server does two things:
    #  1) authenticates enrollment requests which contain a username and password
    #     (also known as an enrollment ID and secret).
    #  2) once authenticated, retrieves the identity's attribute names and
    #     values which the fabric-ca-server optionally puts into TCerts
    #     which it issues for transacting on the Hyperledger Fabric blockchain.
    #     These attributes are useful for making access control decisions in
    #     chaincode.
    #  There are two main configuration options:
    #  1) The fabric-ca-server is the registry.
    #     This is true if "ldap.enabled" in the ldap section below is false.
    #  2) An LDAP server is the registry, in which case the fabric-ca-server
    #     calls the LDAP server to perform these tasks.
    #     This is true if "ldap.enabled" in the ldap section below is true,
    #     which means this "registry" section is ignored.
    #############################################################################
    #当fabric-ca-server自身提供用户的注册管理时使用, 此情况下需要禁用LDAP功能, 否则fabric-ca-server将会把注册管理数据转发到LDAP进行查询
    registry:
      # Maximum number of times a password/secret can be reused for enrollment
      # (default: -1, which means there is no limit)
      # 允许同一个用户名和密码进行enrollment的最大次数, -1为无限制, 0为不支持登记
      maxenrollments: -1
    
      # Contains identity information which is used when LDAP is disabled
      identities:     # 注册的实体信息, 可以进行enroll. 只有当LDAP未启用时起作用
         - name: ywhtest
           pass: ywh123456
           type: client
           affiliation: ""
           maxenrollments: -1
           attrs:
              hf.Registrar.Roles: "client,user,peer,validator,auditor"
              hf.Registrar.DelegateRoles: "client,user,validator,auditor"
              hf.Revoker: true
              hf.IntermediateCA: true
    
    #############################################################################
    #  Database section
    #  Supported types are: "sqlite3", "postgres", and "mysql".
    #  The datasource value depends on the type.
    #  If the type is "sqlite3", the datasource value is a file name to use
    #  as the database store.  Since "sqlite3" is an embedded database, it
    #  may not be used if you want to run the fabric-ca-server in a cluster.
    #  To run the fabric-ca-server in a cluster, you must choose "postgres"
    #  or "mysql".
    #############################################################################
    #数据库支持SQLite3、MySQL、Postgres. 默认为SQLite3类型的本地数据库. 如果要配置集群, 则需要选用MySQL或Postgres后端数据库, 并在前端部署负载均衡器(如Nginx或HAProxy)
    db:
      type: postgres
      datasource: host=172.31.145.194 port=5432 user=postgres password=postgres dbname=ca #host一定要写本机的内网地址，不要写127.0.0.1 sslmode=disable
      tls:
          enabled: false  #是否启用TLS来连接到数据库
          certfiles:    #PEM格式的数据库服务器的TLS根证书, 可以指定多个, 用逗号隔开
            - db-server-cert.pem  
          client:
            certfile: db-client-cert.pem    # PEM格式的客户端证书文件
            keyfile: db-client-key.pem      # PEM格式的客户端证书私钥文件
    
    #############################################################################
    #  LDAP section
    #  If LDAP is enabled, the fabric-ca-server calls LDAP to:
    #  1) authenticate enrollment ID and secret (i.e. username and password)
    #     for enrollment requests;
    #  2) To retrieve identity attributes
    #############################################################################
    # 配置使用远端的LDAP来进行注册管理, 认证enrollment的用户和密码, 并获取用户属性信息. 此时, 服务端将按照指定的usrfilter从LDAP获取对应的用户, 利用其唯一识别名(distinguidhed name)和给定的密码进行验证. 
    # 当LDAP功能启用时, registry中的配置将被忽略
    ldap:
       # Enables or disables the LDAP client (default: false)
       # If this is set to true, the "registry" section is ignored.
       enabled: false     # 是否启用LDAP, 默认不启用
       # The URL of the LDAP server
       url: ldap://<adminDN>:<adminPassword>@<host>:<port>/<base>
       tls:
          certfiles:
            - ldap-server-cert.pem
          client:
             certfile: ldap-client-cert.pem
             keyfile: ldap-client-key.pem
    
    #############################################################################
    #  Affiliation section
    #############################################################################
    # 组织结构配置，这个会存到Postgresql数据库中
    affiliations:
       org1:
          - department1
       org2:
          - department2
    
    #############################################################################
    #  Signing section
    #
    #  The "default" subsection is used to sign enrollment certificates;
    #  the default expiration ("expiry" field) is "8760h", which is 1 year in hours.
    #
    #  The "ca" profile subsection is used to sign intermediate CA certificates;
    #  the default expiration ("expiry" field) is "43800h" which is 5 years in hours.
    #  Note that "isca" is true, meaning that it issues a CA certificate.
    #  A maxpathlen of 0 means that the intermediate CA cannot issue other
    #  intermediate CA certificates, though it can still issue end entity certificates.
    #  (See RFC 5280, section 4.2.1.9)
    #############################################################################
    # 签发证书相关的配置包括签名方法、证书超时时间等. fabric-ca-server可以作为用户证书的签发CA(默认情况下), 也可以作为根CA来进一步支持其它中间CA
    signing:
        default:      # 默认情况下,用于签署Ecert
          usage:      # 所签发证书的KeyUsage extension域
            - digital signature
          expiry: 8760h
        profiles:    # 不同的签发配置
          ca:        # 签署中间层CA证书时的配置模板
             usage:
               - cert sign    # 所签发证书的KeyUsage extension域
             expiry: 43800h
             caconstraint:
               isca: true
               maxpathlen: 0    # 限制该中间层CA无法进一步签署中间层CA
    
    ###########################################################################
    #  Certificate Signing Request (CSR) section.
    #  This controls the creation of the root CA certificate.
    #  The expiration for the root CA certificate is configured with the
    #  "ca.expiry" field below, whose default value is "131400h" which is
    #  15 years in hours.
    #  The pathlength field is used to limit CA certificate hierarchy as described
    #  in section 4.2.1.9 of RFC 5280.
    #  Examples:
    #  1) No pathlength value means no limit is requested.
    #  2) pathlength == 1 means a limit of 1 is requested which is the default for
    #     a root CA.  This means the root CA can issue intermediate CA certificates,
    #     but these intermediate CAs may not in turn issue other CA certificates
    #     though they can still issue end entity certificates.
    #  3) pathlength == 0 means a limit of 0 is requested;
    #     this is the default for an intermediate CA, which means it can not issue
    #     CA certificates though it can still issue end entity certificates.
    ###########################################################################
    #csr:                 # CA自身证书的申请请求配置. 当CA作为根证书服务时, 将基于请求生成一个自签名的证书; 当CA作为中间证书服务时, 将请求发送给上层的根证书进行签署 
    #   cn:               # 建议与服务器名一致
    #   names:
    #      - C: CN  
    #        ST: beijing
    #        L: beijing
    #        O: xitech
    #        OU: xichain
    #   hosts:
    #     - organizations.xionbockchain.marathon.xichain.com.cn
    #   ca:       # 配置后会加入到证书的扩展字段
    #      expiry: 131400h
    #      pathlength: 1
    
    #############################################################################
    # BCCSP (BlockChain Crypto Service Provider) section is used to select which
    # crypto library implementation to use
    #############################################################################
    bccsp:        # 配置所选择的加密库
        default: SW
        sw:
            hash: SHA2
            security: 256
            filekeystore:
                # The directory used for the software file-based keystore
                keystore: msp/keystore           # 存放密钥文件的路径
    
    #############################################################################
    # Multi CA section
    #
    # Each Fabric CA server contains one CA by default.  This section is used
    # to configure multiple CAs in a single server.
    #
    # 1) --cacount <number-of-CAs>
    # Automatically generate <number-of-CAs> non-default CAs.  The names of these
    # additional CAs are "ca1", "ca2", ... "caN", where "N" is <number-of-CAs>
    # This is particularly useful in a development environment to quickly set up
    # multiple CAs.
    #
    # 2) --cafiles <CA-config-files>
    # For each CA config file in the list, generate a separate signing CA.  Each CA
    # config file in this list MAY contain all of the same elements as are found in
    # the server config file except port, debug, and tls sections.
    #
    # Examples:
    # fabric-ca-server start -b admin:adminpw --cacount 2
    #
    # fabric-ca-server start -b admin:adminpw --cafiles ca/ca1/fabric-ca-server-config.yaml
    # --cafiles ca/ca2/fabric-ca-server-config.yaml
    #
    #############################################################################
    
    cacount:
    
    cafiles:
    
    #############################################################################
    # Intermediate CA section
    #
    # The relationship between servers and CAs is as follows:
    #   1) A single server process may contain or function as one or more CAs.
    #      This is configured by the "Multi CA section" above.
    #   2) Each CA is either a root CA or an intermediate CA.
    #   3) Each intermediate CA has a parent CA which is either a root CA or another intermediate CA.
    #
    # This section pertains to configuration of #2 and #3.
    # If the "intermediate.parentserver.url" property is set,
    # then this is an intermediate CA with the specified parent
    # CA.
    #
    # parentserver section
    #    url - The URL of the parent server
    #    caname - Name of the CA to enroll within the server
    #
    # enrollment section used to enroll intermediate CA with parent CA
    #    profile - Name of the signing profile to use in issuing the certificate
    #    label - Label to use in HSM operations
    #
    # tls section for secure socket connection
    #   certfiles - PEM-encoded list of trusted root certificate files
    #   client:
    #     certfile - PEM-encoded certificate file for when client authentication
    #     is enabled on server
    #     keyfile - PEM-encoded key file for when client authentication
    #     is enabled on server
    #############################################################################
    intermediate:
      parentserver:
        url:
        caname:
    
      enrollment:
        hosts:
        profile:
        label:
    
      tls:
        certfiles:
        client:
          certfile:
          keyfile:

1.3.编写启动配置文件ca.yaml文件

[root@node6 ~]# mkdir -p /u01/chainConfig/configfile/ca
    
    [root@node6 ~]# cd /u01/chainConfig/configfile/ca
    
    [root@node6 ~]# vi ca.yaml
    
    vi ca.yaml
    version: '2'
    
    services:
      ca:
        image: hyperledger/fabric-ca:x86_64-1.0.1
        ports:
          - "7054:7054"
        command: sh -c "fabric-ca-server start -b admin:adminpw -d"
        environment:
          - FABRIC_CA_HOME=/etc/hyperledger/fabric-ca-server
        volumes:
          -  /u01/ca:/etc/hyperledger/fabric-ca-server

1.4 在启动CA服务之前，我们要选择一个组织作为CA节点的根，也就说用哪个组织的根证书去发行证书，在前几篇博文中我们配置了五个org，我这里选择org1作为发行证书的根,把ca下的证书复制并重新命名，新的名字是根据fabric-ca-server-config.yaml文件中设置的名字一样。

[root@node6 ~]# cp /u01/chainConfig/crypto-config/peerOrganizations/ywhOrg1.example.com/ca/ca.ywhOrg1.example.com-cert /u01/ca/ca-cert.pem
    
    [root@node6 ~]# cd /u01/chainConfig/crypto-config/peerOrganizations/ywhOrg2.example.com/ca/*_sk /u01/ca/ca-key.pem
    
    #如果在fabric-ca-server-config.yaml文件中关闭了tls  这个命令就可以不用运行
    [root@node6 ~]# mv /u01/chainConfig/crypto-config/peerOrganizations/ywhOrg1.example.com/users/User1\@ywhOrg1.example.com/tls/* /u01/ca

1.5 在把配置文件和我们所需要的证书都完成后，启动CA服务就可以了

[root@node6 ~]# docker-compose -f /u01/chainConfig/configfile/ca/ca.yaml up -d

**2.申请用户**

2.1 CA启动以后我们要使用CA服务来测试能否申请用户，并发行证书，使用脚本申请用户的时候可以先把tls通讯关闭，否则会报通讯的错误。

关于fabric-ca-client命令可以上网查询一下，这个命令在之前下载的平台特定二进制文件中没有，需要自己另外下载并放到bin目录下

下载地址：[https://nexus.hyperledger.org/content/repositories/releases/org/hyperledger/fabric-ca/][https_nexus.hyperledger.org_content_repositories_releases_org_hyperledger_fabric-ca]

我下载的是liunx-adm64的

[root@node6 ~]# mkdir -p /u01/users/
    
    [root@node6 ~]# cd /u01/users/
    
    [root@node6 ~]# vi createUser.sh
    
    #!/bin/bash
    
    USERNAME=test
    CALOCATION=47.104.255.180:7054
    #修改为当前CA的IP和端口
    
    #
    # enroll admin, after enroll admin, the msp files will store in the default msp directory. 
    # if the msp directory doesn't exist, we need to enroll an new pair of cert and prikey 
    #
    #
    enrollAdmin () {
    echo enroll admin  
    fabric-ca-client enroll -u http://lianpai:lianpai888@${CALOCATION} 
    }
    
    # 
    # create new user, 
    #
    createUser () {
        echo
        echo
        echo Createuser ${USERNAME}----#########################################################
    
        fabric-ca-client register --id.name ${USERNAME} --id.type peer --id.affiliation lianpai.baochain  \
            --id.attrs hf.Revoker=true --id.attrs '"hf.Registrar.Roles=user,peer,client,validator,auditor"'  \
            --id.attrs hf.IntermediateCA=true --id.attrs '"hf.Registrar.DelegateRoles=user,peer,client,validator,auditor"'  \
            --id.secret ${USERNAME}pw 
    
    
        fabric-ca-client enroll --csr.hosts ${USERNAME} -u http://${USERNAME}:${USERNAME}pw@${CALOCATION} --mspdir /$(pwd)/${USERNAME}/msp/ 
    
    }
    
    
    
    start () {
    export PATH=$PATH:/u01/chainConfig/bin
    	sleep 0.001
        enrollAdmin
    	sleep 0.001
        createUser  
    
    }
    
    USERNAME=$1
    echo --------------------------------------------------------
    echo ----------create msp files for $USERNAME ----------------
    echo --------------------------------------------------------
    start
    
    
    [root@node6 ~]# sh createUser.sh test   #如果没有关闭tls的话 就会跟下面一样，有个错误
    [root@node7 users]# sh createUser.sh test
    --------------------------------------------------------
    ----------create msp files for test ----------------
    --------------------------------------------------------
    enroll admin
    2018/09/30 15:46:41 [INFO] User provided config file: /root/.fabric-ca-client/fabric-ca-client-config.yaml
    2018/09/30 15:46:41 [INFO] generating key: &{A:ecdsa S:256}
    2018/09/30 15:46:41 [INFO] encoded CSR
    Error: POST failure [Post http://172.31.145.195:7054/enroll: malformed HTTP response "\x15\x03\x01\x00\x02\x02\x16"]; not sending
    POST http://172.31.145.195:7054/enroll
    Authorization: Basic c3l0ZXN0OnN5MTIzNDU2
    {"hosts":["node7"],"certificate_request":"-----BEGIN CERTIFICATE REQUEST-----\nMIIBOzCB4wIBADBeMQswCQYDVQQGEwJVUzEXMBUGA1UECBMOTm9ydGggQ2Fyb2xp\nbmExFDASBgNVBAoTC0h5cGVybGVkZ2VyMQ8wDQYDVQQLEwZGYWJyaWMxDzANBgNV\nBAMTBnN5dGVzdDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABDW+oKepIc235APE\n/z1OxDtcpO+5ICywf9vAd+93/Jxe3fv7DpPDxtZB0OR62iuaZoiki9v3i887s4Hz\nye9WO/igIzAhBgkqhkiG9w0BCQ4xFDASMBAGA1UdEQQJMAeCBW5vZGU3MAoGCCqG\nSM49BAMCA0cAMEQCIH7A6bgBoqMYZGWDyV1GGCczWeeQuwCmbODfwaDDoOFqAiA1\nDA9NT741Po5PngxujcenjFiGqJ0GcAtbZttD4dupDQ==\n-----END CERTIFICATE REQUEST-----\n","profile":"","crl_override":"","label":"","CAName":""}
    
    
    Createuser test----#########################################################
    2018/09/30 15:46:41 [INFO] User provided config file: /root/.fabric-ca-client/fabric-ca-client-config.yaml
    2018/09/30 15:46:41 [INFO] Configuration file location: /root/.fabric-ca-client/fabric-ca-client-config.yaml
    Error: POST failure [Post http://172.31.145.195:7054/register: malformed HTTP response "\x15\x03\x01\x00\x02\x02\x16"]; not sending
    POST http://172.31.145.195:7054/register
    Authorization: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNZRENDQWdhZ0F3SUJBZ0lVVW9vQ1E1cVJKcHZ6MHBnZmN2UGNBMzdCSUdnd0NnWUlLb1pJemowRUF3SXcKZ1lFeEN6QUpCZ05WQkFZVEFsVlRNUk13RVFZRFZRUUlFd3BEWVd4cFptOXlibWxoTVJZd0ZBWURWUVFIRXcxVApZVzRnUm5KaGJtTnBjMk52TVNBd0hnWURWUVFLRXhkemVURnZjbWN1YzNsMFpYTjBZMmhoYVc0dVkyeDFZakVqCk1DRUdBMVVFQXhNYVkyRXVjM2t4YjNKbkxuTjVkR1Z6ZEdOb1lXbHVMbU5zZFdJd0hoY05NVGd3T1RFNE1EZ3oKT1RBd1doY05NVGt3T1RFNE1EZ3pPVEF3V2pCZU1Rc3dDUVlEVlFRR0V3SlZVekVYTUJVR0ExVUVDQk1PVG05eQpkR2dnUTJGeWIyeHBibUV4RkRBU0JnTlZCQW9UQzBoNWNHVnliR1ZrWjJWeU1ROHdEUVlEVlFRTEV3WkdZV0p5CmFXTXhEekFOQmdOVkJBTVRCbk41ZEdWemREQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJHM2EKTE1NU1hadjdLdWtFSWV1OW8rWVVNcGFQQkR6aWFKREhjUFVPL3daK2RSUEtaVngyakk0TFVHUEhMbndCUXBXdgp6eFNVWXB3bTZOdVpTWmk0cjBtamZqQjhNQTRHQTFVZER3RUIvd1FFQXdJSGdEQU1CZ05WSFJNQkFmOEVBakFBCk1CMEdBMVVkRGdRV0JCUkd6bG1lQ1NIMGdhSWtmM2w3VmhYb3RwRlN4VEFyQmdOVkhTTUVKREFpZ0NDRkxZTloKOUVIQjFlU3lRZnQxUUo3eDh1Vkc0dytIYkZab21KeWpNSmsyU0RBUUJnTlZIUkVFQ1RBSGdnVnViMlJsTnpBSwpCZ2dxaGtqT1BRUURBZ05JQURCRkFpRUE5ajBKMVQxVzk3TDNFTVJ1aUcyelpwWnhRWk1OUWlwUlZjbUdxM21jClBBVUNJQkNtYk9JRTdTNGR3a2Q5cTVQL1dwSm82ZHZTOHBZREp6Z0NmY1VUTUJqbgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==.MEQCICKAJNRJCWfrViXKcWDGA5206751TSL9fISOOdg8rxO0AiBJaNjsF6HCYSSAMEp+e7qLR0zg2lRaIGky8ngkzFwWgQ==
    {"id":"test","type":"peer","secret":"testpw","max_enrollments":-1,"affiliation":"sytest.sy123456","attrs":[{"name":"hf.Revoker","value":"true"},{"name":"hf.Registrar.Roles","value":"user,peer,client,validator,auditor"},{"name":"hf.IntermediateCA","value":"true"},{"name":"hf.Registrar.DelegateRoles","value":"user,peer,client,validator,auditor"}]}
    2018/09/30 15:46:41 [INFO] User provided config file: /root/.fabric-ca-client/fabric-ca-client-config.yaml
    2018/09/30 15:46:41 [INFO] generating key: &{A:ecdsa S:256}
    2018/09/30 15:46:41 [INFO] encoded CSR
    Error: POST failure [Post http://172.31.145.195:7054/enroll: malformed HTTP response "\x15\x03\x01\x00\x02\x02\x16"]; not sending
    POST http://172.31.145.195:7054/enroll
    Authorization: Basic dGVzdDp0ZXN0cHc=
    {"hosts":["test"],"certificate_request":"-----BEGIN CERTIFICATE REQUEST-----\nMIIBOTCB4AIBADBcMQswCQYDVQQGEwJVUzEXMBUGA1UECBMOTm9ydGggQ2Fyb2xp\nbmExFDASBgNVBAoTC0h5cGVybGVkZ2VyMQ8wDQYDVQQLEwZGYWJyaWMxDTALBgNV\nBAMTBHRlc3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATkRbdsh6KRGFDjob2N\nn9vU1+HMWIIrUFJpYxVNMXu7ZJ8MaiOCgvSCRtR9tyQZ6WXpkk6pa5nWoMV1HrYy\nKqpDoCIwIAYJKoZIhvcNAQkOMRMwETAPBgNVHREECDAGggR0ZXN0MAoGCCqGSM49\nBAMCA0gAMEUCIQDkooKJY7vBP8lhXG7qPOFHRQS6cAcU6nB5vn3RjGN14gIgawX2\n0Hb5Tb8bTS21MHGE26t9tLz8+MIX5jFX2RsMnGo=\n-----END CERTIFICATE REQUEST-----\n","profile":"","crl_override":"","label":"","CAName":""}
    
    
    [root@node7 users]# sh createUser.sh test1    #这是没有开启tls的，成功注册了一个用户  密码是testpw
    --------------------------------------------------------
    ----------create msp files for test1 ----------------
    --------------------------------------------------------
    enroll admin
    2018/09/30 15:49:59 [INFO] User provided config file: /root/.fabric-ca-client/fabric-ca-client-config.yaml
    2018/09/30 15:49:59 [INFO] generating key: &{A:ecdsa S:256}
    2018/09/30 15:49:59 [INFO] encoded CSR
    2018/09/30 15:49:59 [INFO] Stored client certificate at /root/.fabric-ca-client/msp/signcerts/cert.pem
    2018/09/30 15:49:59 [INFO] Stored CA root certificate at /root/.fabric-ca-client/msp/cacerts/172-31-145-195-7054.pem
    
    
    Createuser test1----#########################################################
    2018/09/30 15:49:59 [INFO] User provided config file: /root/.fabric-ca-client/fabric-ca-client-config.yaml
    2018/09/30 15:49:59 [INFO] Configuration file location: /root/.fabric-ca-client/fabric-ca-client-config.yaml
    Password: test1pw
    2018/09/30 15:49:59 [INFO] User provided config file: /root/.fabric-ca-client/fabric-ca-client-config.yaml
    2018/09/30 15:49:59 [INFO] generating key: &{A:ecdsa S:256}
    2018/09/30 15:49:59 [INFO] encoded CSR
    2018/09/30 15:49:59 [INFO] Stored client certificate at /u01/users/test1/msp/signcerts/cert.pem
    2018/09/30 15:49:59 [INFO] Stored CA root certificate at /u01/users/test1/msp/cacerts/172-31-145-195-7054.pem

相应的在/u01/users文件夹中也出现了test和test1两个文件夹，一个失败的和一个成功的，可以对比一下两个文件夹下的东西。

上面部署的是CA服务，tls的跟上面唯一区别就是证书用的不同，一个用的是ca文件夹下的，一个是用的tlsca文件夹下的

走到这里，CA服务的申请用户基本完成了。

[https_www.cnblogs.com_studyzy_category_1024666.html]: https://www.cnblogs.com/studyzy/category/1024666.html
[https_www.cnblogs.com_aberic_category_1148898.html]: https://www.cnblogs.com/aberic/category/1148898.html
[70]: /images/20220509/fca34ffaf4714c51b75212c89e0fb59c.png
[https_hyperledger-fabric-ca.readthedocs.io_en_latest]: https://hyperledger-fabric-ca.readthedocs.io/en/latest/
[https_blog.csdn.net_baidu_39649815_article_details_76259031]: https://blog.csdn.net/baidu_39649815/article/details/76259031
[https_nexus.hyperledger.org_content_repositories_releases_org_hyperledger_fabric-ca]: https://nexus.hyperledger.org/content/repositories/releases/org/hyperledger/fabric-ca/