HYPERLEDGER FABRIC-CA学习

Love The Way You Lie 2022-05-25 00:27 326阅读 0赞

**概述**  
fabric-ca 是hyperledger的一个子项目,其功能主要是提供证书生成以及管理  
Hyperleder Fabric系统架构核心逻辑包括MemberShip、Blockchain和Chaincode  
![01][]

> 其中上述3个核心逻辑中，Membership服务用来管理节点身份、隐私、confidentiality 和 auditability。在一个  
> non-permissioned的区块链网络里，参与者不要求授权，所有的节点被视作一样，都可以提交一个transaction，去把这些交易存到区块（blocks）中。Membership  
> Service将一个 non-permissioned的区块链网络变成一个permissioned的区块链网络，凭借着Public Key  
> Infrastructure (PKI)、去中心和一致性。
> 
> 从上面的描述中可以看出，对于一个隐私性要求较高，节点需要授权才可以加入区块链网络并节点可能存在不同角色的区块链我那个链，Membership从中起到授权用户、加密传输数据的作用。在Fabric  
> 1.0版本中，MemberShip Service替换成fabric-ca模块。由于CA在pemissioned区块链网络中的重要作用，Fabric也将CA作为一个单独的模块，可以独立运行，其代码可从[https://github.com/hyperledger/fabric-ca][https_github.com_hyperledger_fabric-ca]获取得到。

下面的图表描述了CA 服务器在Hyperleder Fabric框架体系架构中的工作方式：  
![fa][]

从表中可以看出，CA 服务器结构为树形结构，整个树形结构的根节点为根CA（Root Server），存在多个中间CA（Intermediate CA），图中每个中间CA服务器上可以配置一个CA服务集群，CA服务集群通过前置的HAproxy实现负载均衡。

Fabric CA提供了两种访问方式调用Server服务，一种是通过Client调用，另一种是通过SDK调用。两种调用都是REST风格的。本文使用的是通过Client调用。

接下来，参考fabric-ca官方文档说明要求，针对fabric-ca的请求/发放证书、注册节点等操作实践操作一遍已加深理解。

系统环境

[root@fabric-cli fabric-ca]# cat /etc/redhat-release 
    CentOS Linux release 7.4.1708 (Core)

获取代码以及安装编译环境

git clone https://github.com/hyperledger/fabric-ca.git
    git checkout v1.1.0

yum install golang libtool-ltdl-devel -y

设置gopath

[root@fabric-cli ca1]# pwd
    /root/src/github.com/hyperledger/fabric-ca/cmd/fabric-ca-server/ca/ca1
    [root@fabric-cli ca1]# echo $GOPATH
    /root/

如果直接执行就不用修改github.com/hyperledger/fabric-ca/lib/version.go文件了

go get -u github.com/hyperledger/fabric-ca/cmd/...

修改github.com/hyperledger/fabric-ca/lib/version.go

// GetVersion returns the version
    func GetVersion() string {
        if Version == "" {
            Version="1.1.0" //添加这一行
            panic("Version is not set for fabric-ca library")
        }
        return Version
    }

如果不修改会报错

[root@fabric-cli fabric-ca-server]# ./fabric-ca-server start -b admin:adminpw
    2018/05/04 16:21:06 [INFO] Configuration file location: /root/src/github.com/hyperledger/fabric-ca/cmd/fabric-ca-server/fabric-ca-server-config.yaml
    2018/05/04 16:21:06 [INFO] Starting server in home directory: /root/src/github.com/hyperledger/fabric-ca/cmd/fabric-ca-server
    panic: Version is not set for fabric-ca library
    
    goroutine 1 [running]:
    github.com/hyperledger/fabric-ca/lib/metadata.GetVersion(0x1, 0xc4202973b0)
        /root/src/github.com/hyperledger/fabric-ca/lib/metadata/version.go:58 +0x8b
    github.com/hyperledger/fabric-ca/lib.(*Server).init(0xc420274a20, 0x0, 0xc420103bd8, 0x1)
        /root/src/github.com/hyperledger/fabric-ca/lib/server.go:98 +0x29
    github.com/hyperledger/fabric-ca/lib.(*Server).Start(0xc420274a20, 0xc420274a20, 0xc4200158d4)
        /root/src/github.com/hyperledger/fabric-ca/lib/server.go:131 +0xee
    main.(*ServerCmd).init.func3(0xc42006efc0, 0xc420168520, 0x0, 0x2, 0x0, 0x0)
        /root/src/github.com/hyperledger/fabric-ca/cmd/fabric-ca-server/ser
        ...

编译

cd /root/src/github.com/hyperledger/fabric-ca/cmd/fabric-ca-server
    go build
    cd /root/src/github.com/hyperledger/fabric-ca/cmd/fabric-ca-client
    go build

启动fabric-ca-server:  
使用命令fabric-ca-server start -b admin:adminpw –cacount 2启动了一个包含了2个CA服务簇的CA server

[root@fabric-cli first]# fabric-ca-server start -b admin:adminpw --cacount 2 2018/05/05 09:41:53 [INFO] Created default configuration file at /root/first/fabric-ca-server-config.yaml 2018/05/05 09:41:53 [INFO] Starting server in home directory: /root/first 2018/05/05 09:41:53 [INFO] Server Version: 1.1.0 2018/05/05 09:41:53 [INFO] Server Levels: &{ Identity:1 Affiliation:1 Certificate:1} 2018/05/05 09:41:53 [INFO] Loading CA from /root/first/ca/ca1/fabric-ca-config.yaml 2018/05/05 09:41:53 [INFO] generating key: &{A:ecdsa S:256} 2018/05/05 09:41:53 [INFO] encoded CSR 2018/05/05 09:41:53 [INFO] signed certificate with serial number 311619704474802174194156511492686636990995466448 2018/05/05 09:41:53 [INFO] The CA key and certificate were generated for CA ca1 2018/05/05 09:41:53 [INFO] The key was stored by BCCSP provider 'SW' 2018/05/05 09:41:53 [INFO] The certificate is at: /root/first/ca/ca1/ca-cert.pem 2018/05/05 09:41:53 [INFO] Initialized sqlite3 database at /root/first/ca/ca1/fabric-ca-server_ca1.db 2018/05/05 09:41:53 [INFO] Loading CA from /root/first/ca/ca2/fabric-ca-config.yaml 2018/05/05 09:41:53 [INFO] generating key: &{A:ecdsa S:256} 2018/05/05 09:41:53 [INFO] encoded CSR 2018/05/05 09:41:53 [INFO] signed certificate with serial number 9675068947773322809591550487667362524005377001 2018/05/05 09:41:53 [INFO] The CA key and certificate were generated for CA ca2 2018/05/05 09:41:53 [INFO] The key was stored by BCCSP provider 'SW' 2018/05/05 09:41:53 [INFO] The certificate is at: /root/first/ca/ca2/ca-cert.pem 2018/05/05 09:41:53 [INFO] Initialized sqlite3 database at /root/first/ca/ca2/fabric-ca-server_ca2.db 2018/05/05 09:41:53 [INFO] generating key: &{A:ecdsa S:256} 2018/05/05 09:41:53 [INFO] encoded CSR 2018/05/05 09:41:53 [INFO] signed certificate with serial number 692411238091865327503936658426428018548545759152 2018/05/05 09:41:53 [INFO] The CA key and certificate were generated for CA 2018/05/05 09:41:53 [INFO] The key was stored by BCCSP provider 'SW' 2018/05/05 09:41:53 [INFO] The certificate is at: /root/first/ca-cert.pem 2018/05/05 09:41:53 [INFO] Initialized sqlite3 database at /root/first/fabric-ca-server.db 2018/05/05 09:41:53 [INFO] Home directory for default CA: /root/first 2018/05/05 09:41:53 [INFO] Listening on http://0.0.0.0:7054

启动CA server后，在服务器根目录下分别新建了一个ca1和ca2两个文件夹，启动过程中服务器首先通过ecdsa SHA256算法生成密钥，然后编码生成CSR（证书签名请求，CSR签名请求中包含了请求用户的城市、公司等基本信息），CA服务器对CSR中的基本信息通过数字签名制作数字证书并颁发给申请者。上图可以看出最终生成的CA证书最终存储在ca1和ca2文件夹下的ca-cert.pem文件里。生成数字证书后，CA服务器会将证书信息写入到数据库或LDAP目录服务器中。上图中默认存放在ca1和ca2文件夹下的sqlite3 db中。

[root@fabric-cli first]# tree
    .
    ├── ca
    │   ├── ca1
    │   │   ├── ca-cert.pem
    │   │   ├── fabric-ca-config.yaml
    │   │   ├── fabric-ca-server_ca1.db
    │   │   └── msp
    │   │       └── keystore
    │   │           └── 9698af7f2faf00d9fb0bde5e310862ea8cd7ace4b66144f229e661d125eaf559_sk
    │   └── ca2
    │       ├── ca-cert.pem
    │       ├── fabric-ca-config.yaml
    │       ├── fabric-ca-server_ca2.db
    │       └── msp
    │           └── keystore
    │               └── a5f81a8b7a8eb78f033d44d2454fbb4a01b4751d26d7c5837daf9cd9f93abb1d_sk
    ├── ca-cert.pem
    ├── fabric-ca-server-config.yaml
    ├── fabric-ca-server.db
    └── msp
        └── keystore
            └── b848bc83ee2bfebe64a3f046781b0eb4f9f628fcb26ffa6f207dd28c406f3a85_sk
    
    9 directories, 12 files

切换到ca1文件夹下，通过openssl命令查看证书内容：

[root@fabric-cli ca]# cd ca1/
    [root@fabric-cli ca1]# ls -l
    总用量 48
    [root@fabric-cli ca1]# openssl x509 -in ca-cert.pem -inform pem -noout -text
    Certificate:
        Data:
            Version: 3 (0x2)
            Serial Number:
                36:95:82:c5:89:a0:43:25:19:0c:58:db:d9:d4:75:13:13:7d:88:d0
        Signature Algorithm: ecdsa-with-SHA256
            Issuer: C=US, ST=North Carolina, O=Hyperledger, OU=Fabric, CN=fabric-ca-server-ca1
            Validity
                Not Before: May  5 01:37:00 2018 GMT
                Not After : May  1 01:37:00 2033 GMT
            Subject: C=US, ST=North Carolina, O=Hyperledger, OU=Fabric, CN=fabric-ca-server-ca1
            Subject Public Key Info:
                Public Key Algorithm: id-ecPublicKey
                    Public-Key: (256 bit)
                    pub: 
                        04:9a:7b:4b:53:e1:2c:a0:df:62:13:37:c2:3d:a6:
                        fb:b4:6c:46:3e:b1:9c:c5:88:13:c1:ee:d4:09:e9:
                        ca:f5:19:05:d8:6c:ad:b6:25:40:19:5d:dd:ed:7e:
                        f9:61:63:3d:a6:b7:ef:8b:e0:0c:21:8b:6f:38:d4:
                        08:93:bc:1f:0a
                    ASN1 OID: prime256v1
                    NIST CURVE: P-256
            X509v3 extensions:
                X509v3 Key Usage: critical
                    Certificate Sign, CRL Sign
                X509v3 Basic Constraints: critical
                    CA:TRUE, pathlen:1
                X509v3 Subject Key Identifier: 
                    3C:7F:B6:D4:7E:80:64:C9:2F:31:17:68:18:19:38:C4:5C:08:6D:C3
        Signature Algorithm: ecdsa-with-SHA256
             30:45:02:21:00:85:32:25:54:07:24:3f:dd:ff:65:78:a2:9b:
             63:3c:2d:8a:1b:5d:29:77:e6:31:89:3b:0b:61:b5:84:b3:63:
             ca:02:20:7f:2a:2f:e4:c9:aa:fd:75:65:dc:f9:22:ce:71:4e:
             11:0a:f3:68:28:b7:72:3b:dd:b0:c0:4a:88:d5:bb:1b:f3

从上面的信息可以看到，数字证书包含了签名算法信息、申请者基本信息、申请者公钥信息等。

打开存储发放证书信息的sqlite3 数据库：

可以看到数据库中有3个表，其中users表中目前只有启动时设定的引导节点，还没有注册其他节点。certificates表中目前没有任何发放证书记录。

现在我们尝试使用fabric-ca先登记引导节点，命令如下：

fabric-ca-client enroll -H $PWD -u http://admin:adminpw@localhost:7054

这里admin和adminpw即为fabric-ca-server启动时设置的引导节点登记id和密码  
client执行结果如下：

[root@fabric-cli client-01]# fabric-ca-client enroll -H $PWD -u http://admin:adminpw@localhost:7054
    2018/05/05 09:45:38 [INFO] Created a default configuration file at /root/client-01/fabric-ca-client-config.yaml
    2018/05/05 09:45:38 [INFO] generating key: &{A:ecdsa S:256}
    2018/05/05 09:45:38 [INFO] encoded CSR
    2018/05/05 09:45:39 [INFO] Stored client certificate at /root/client-01/msp/signcerts/cert.pem
    2018/05/05 09:45:39 [INFO] Stored root CA certificate at /root/client-01/msp/cacerts/localhost-7054.pem
    2018/05/05 09:45:39 [INFO] Stored intermediate CA certificates at /root/client-01/msp/intermediatecerts/localhost-7054.pem

server端接收到登记请求：

2018/05/05 09:45:39 [INFO] signed certificate with serial number 113565818925120426742161970700227134872628277937
    2018/05/05 09:45:39 [INFO] [::1]:53454 POST /enroll 201 0 "OK"

在ca-client目录下生成的目录结构如下：

[root@fabric-cli client-01]# tree
    .
    ├── fabric-ca-client-config.yaml
    └── msp
        ├── cacerts
        │   └── localhost-7054.pem
        ├── intermediatecerts
        │   └── localhost-7054.pem
        ├── keystore
        │   └── e9c5eaf48a95a9c32ec06db17cf608339526094309aca2a65f30302a52d8920d_sk
        └── signcerts
            └── cert.pem
    
    5 directories, 5 files

回到ca-server目录下，打开sqlite3数据库，可以看到刚刚颁发的数字证书已经记录在数据库里了。

接下来使用fabric-ca-client注册一个新的节点，这一步就是为fabric中的peer、user角色进行注册并登记的过程了，注册的命令为：

fabric-ca-client register --id.name admin2 --id.type user --id.affiliation org1.department1 --id.attrs 'hf.Revoker=true,foo=bar'

这里有两点需要注意：  
1、–id.type参数必须是是server端配置文件里hf.Registrar.Roles属性值里的一个  
打开fabric-ca-server的配置文件

############################################################################# registry: # Maximum number of times a password/secret can be reused for enrollment # (default: -1, which means there is no limit) maxenrollments: -1 # Contains identity information which is used when LDAP is disabled identities: - name: admin pass: adminpw type: client affiliation: "" attrs: hf.Registrar.Roles: "peer,orderer,client,user" hf.Registrar.DelegateRoles: "peer,orderer,client,user" hf.Revoker: true hf.IntermediateCA: true hf.GenCRL: true hf.Registrar.Attributes: "*" hf.AffiliationMgr: true #############################################################################

其中通过hf.Registrar.Roles的属性值可以看出，客户端可以注册的类型有client,user,peer,validator和auditor  
`--id.affiliation`这个属性表示：被注册对象的从属关系参数一定要归属于预先配置的组织属性。换句话说，被注册对象的affiliation参数一定要是预先配置的affiliation参数的一个前缀。例如，假设预先配置的组织关系为：“a.b.c”，那么新注册的对象的affiliation属性可以是“a.b.c”，也可以是“a.b”，但“a.c”就不能通过注册。

[root@fabric-cli client-01]# fabric-ca-client register --id.name admin2 --id.type user -H $PWD --id.affiliation org1.department1 --id.attrs 'hf.Revoker=true,foo=bar'
    2018/05/05 09:51:03 [INFO] Configuration file location: /root/client-01/fabric-ca-client-config.yaml
    Password: JVkuTyRRbnUK

fabric-ca-server 信息

2018/05/05 09:51:03 [INFO] [::1]:53456 POST /register 201 0 "OK"

登记刚刚注册过的admin2节点，登记命令为：

fabric-ca-client enroll -u http://admin2:JVkuTyRRbnUK@localhost:7054 -M $PWD/msp

这里登记时使用的erollId和密码就是上边注册过程中的节点名称和返回的密码信息。这册过程中也是可以指定密码的。  
执行登记命令，结果如下：

[root@fabric-cli client-01]# fabric-ca-client enroll -u http://admin2:JVkuTyRRbnUK@localhost:7054 -M $PWD/msp
    2018/05/05 09:53:45 [INFO] generating key: &{A:ecdsa S:256}
    2018/05/05 09:53:45 [INFO] encoded CSR
    2018/05/05 09:53:45 [INFO] Stored client certificate at /root/client-01/msp/signcerts/cert.pem
    2018/05/05 09:53:45 [INFO] Stored root CA certificate at /root/client-01/msp/cacerts/localhost-7054.pem
    2018/05/05 09:53:45 [INFO] Stored intermediate CA certificates at /root/client-01/msp/intermediatecerts/localhost-7054.pem

fabric-ca-server 信息

2018/05/05 09:53:45 [INFO] signed certificate with serial number 414694951994773083928698018225736094597082642758
    2018/05/05 09:53:45 [INFO] [::1]:53458 POST /enroll 201 0 "OK"

打开fabric-ca-server的sqlite数据库

[root@fabric-cli first]# sqlite3 fabric-ca-server.db
    SQLite version 3.7.17 2013-05-20 00:56:22
    Enter ".help" for instructions
    Enter SQL statements terminated with a ";"
    sqlite> .tables
    affiliations  certificates  properties    users       
    sqlite> select * from users;
    admin|$2a$10$9nTYJLGwnqvFPVSO.wCgwurv9pJ.mwmk//h0/Gcv2LTzC6o7oWbSi|client||[{
       "name":"hf.Registrar.Roles","value":"peer,orderer,client,user"},{
       "name":"hf.Registrar.DelegateRoles","value":"peer,orderer,client,user"},{
       "name":"hf.Revoker","value":"1"},{
       "name":"hf.IntermediateCA","value":"1"},{
       "name":"hf.GenCRL","value":"1"},{
       "name":"hf.Registrar.Attributes","value":"*"},{
       "name":"hf.AffiliationMgr","value":"1"}]|0|-1|1
    sqlite> select * from certificates;
    admin|13e477aa7b82cedbf5cd7a048499113b07ccb2b1|f90f3164321708d0136aba39debee493adef2da||good|0|2019-05-05 01:46:00+00:00|0001-01-01 00:00:00+00:00|-----BEGIN CERTIFICATE-----
    MIICPjCCAeSgAwIBAgIUE+R3qnuCztv1zXoEhJkROwfMsrEwCgYIKoZIzj0EAwIw
    aDELMAkGA1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQK
    EwtIeXBlcmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRkwFwYDVQQDExBmYWJyaWMt
    Y2Etc2VydmVyMB4XDTE4MDUwNTAxNDEwMFoXDTE5MDUwNTAxNDYwMFowXTELMAkG
    A1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQKEwtIeXBl
    cmxlZGdlcjEPMA0GA1UECxMGY2xpZW50MQ4wDAYDVQQDEwVhZG1pbjBZMBMGByqG
    SM49AgEGCCqGSM49AwEHA0IABBfB1sXja/H8BTnyvmHxhq2CqfmQFmNJyZa6w4zw
    fuN94luslQ2HBSiaNWgeKNjM3GzYKMdxnNTadkY/JaguLrOjdzB1MA4GA1UdDwEB
    /wQEAwIHgDAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBSFIoO+i0EDfSif4smmQgQh
    XkisczAfBgNVHSMEGDAWgBQPkPMWQyFwjQE2q6Od6+5JOt7y2jAVBgNVHREEDjAM
    ggpmYWJyaWMtY2xpMAoGCCqGSM49BAMCA0gAMEUCIQDOKII56tG+c1pZDQHVV0yD
    SRrZqVJTr26ISYXCV5Y/dAIgOGAn71VZ6v7AQoAZGV8zIIut1Yt6b/5o6RYHdXWB
    Ngs=
    -----END CERTIFICATE-----
    |1
    sqlite> select * from users;
    admin|$2a$10$9nTYJLGwnqvFPVSO.wCgwurv9pJ.mwmk//h0/Gcv2LTzC6o7oWbSi|client||[{
       "name":"hf.Registrar.Roles","value":"peer,orderer,client,user"},{
       "name":"hf.Registrar.DelegateRoles","value":"peer,orderer,client,user"},{
       "name":"hf.Revoker","value":"1"},{
       "name":"hf.IntermediateCA","value":"1"},{
       "name":"hf.GenCRL","value":"1"},{
       "name":"hf.Registrar.Attributes","value":"*"},{
       "name":"hf.AffiliationMgr","value":"1"}]|1|-1|1
    admin2|$2a$10$euHgYm9FQb4uGem7PoD.5e7OU3An4q7R1FsA5W9d.E6bhf1r.Gd3m|user|org1.department1|[{
       "name":"hf.Revoker","value":"true"},{
       "name":"foo","value":"bar"},{
       "name":"hf.EnrollmentID","value":"admin2","ecert":true},{
       "name":"hf.Type","value":"user","ecert":true},{
       "name":"hf.Affiliation","value":"org1.department1","ecert":true}]|1|-1|1

查看用户信息，其中有一个client节点admin和一个user节点admin2。其中admin是一个intermediateCA。

打开数据库表certificates，这是可以看到给admin2所颁发的证书已经记录了。

qlite> select * from certificates;
    admin|13e477aa7b82cedbf5cd7a048499113b07ccb2b1|f90f3164321708d0136aba39debee493adef2da||good|0|2019-05-05 01:46:00+00:00|0001-01-01 00:00:00+00:00|-----BEGIN CERTIFICATE-----
    MIICPjCCAeSgAwIBAgIUE+R3qnuCztv1zXoEhJkROwfMsrEwCgYIKoZIzj0EAwIw
    aDELMAkGA1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQK
    EwtIeXBlcmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRkwFwYDVQQDExBmYWJyaWMt
    Y2Etc2VydmVyMB4XDTE4MDUwNTAxNDEwMFoXDTE5MDUwNTAxNDYwMFowXTELMAkG
    A1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQKEwtIeXBl
    cmxlZGdlcjEPMA0GA1UECxMGY2xpZW50MQ4wDAYDVQQDEwVhZG1pbjBZMBMGByqG
    SM49AgEGCCqGSM49AwEHA0IABBfB1sXja/H8BTnyvmHxhq2CqfmQFmNJyZa6w4zw
    fuN94luslQ2HBSiaNWgeKNjM3GzYKMdxnNTadkY/JaguLrOjdzB1MA4GA1UdDwEB
    /wQEAwIHgDAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBSFIoO+i0EDfSif4smmQgQh
    XkisczAfBgNVHSMEGDAWgBQPkPMWQyFwjQE2q6Od6+5JOt7y2jAVBgNVHREEDjAM
    ggpmYWJyaWMtY2xpMAoGCCqGSM49BAMCA0gAMEUCIQDOKII56tG+c1pZDQHVV0yD
    SRrZqVJTr26ISYXCV5Y/dAIgOGAn71VZ6v7AQoAZGV8zIIut1Yt6b/5o6RYHdXWB
    Ngs=
    -----END CERTIFICATE-----
    |1
    admin2|48a39095760013a4b0a7987722155c695455f946|f90f3164321708d0136aba39debee493adef2da||good|0|2019-05-05 01:54:00+00:00|0001-01-01 00:00:00+00:00|-----BEGIN CERTIFICATE-----
    MIICyTCCAm+gAwIBAgIUSKOQlXYAE6Swp5h3IhVcaVRV+UYwCgYIKoZIzj0EAwIw
    aDELMAkGA1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQK
    EwtIeXBlcmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRkwFwYDVQQDExBmYWJyaWMt
    Y2Etc2VydmVyMB4XDTE4MDUwNTAxNDkwMFoXDTE5MDUwNTAxNTQwMFowfTELMAkG
    A1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQKEwtIeXBl
    cmxlZGdlcjEuMAsGA1UECxMEdXNlcjALBgNVBAsTBG9yZzEwEgYDVQQLEwtkZXBh
    cnRtZW50MTEPMA0GA1UEAxMGYWRtaW4yMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
    QgAEv6uyVrYvccW2JKx970ssQxZSrIlH+vEcm20aaxWqZOQCBfwUAIo82H+79hg5
    bkPQiOKjVNeVK1lspGzJuEKgYaOB4TCB3jAOBgNVHQ8BAf8EBAMCB4AwDAYDVR0T
    AQH/BAIwADAdBgNVHQ4EFgQUIsG+F7zV+YJUu5LUD2Hs5JcFiiwwHwYDVR0jBBgw
    FoAUD5DzFkMhcI0BNqujnevuSTre8towFQYDVR0RBA4wDIIKZmFicmljLWNsaTBn
    BggqAwQFBgcIAQRbeyJhdHRycyI6eyJoZi5BZmZpbGlhdGlvbiI6Im9yZzEuZGVw
    YXJ0bWVudDEiLCJoZi5FbnJvbGxtZW50SUQiOiJhZG1pbjIiLCJoZi5UeXBlIjoi
    dXNlciJ9fTAKBggqhkjOPQQDAgNIADBFAiEA3ffGpEK32v9ig+EygVgDkEYC1VHW
    90UIZjALrnS/egMCIEFDnwWRSFTQ2oYDUA5C+ZroTvDz1VPJQrcaMlKLjWOm
    -----END CERTIFICATE-----
    |1

重新登记节点，在节点授权即将到期是需要重新登记节点信息。重新登记的命令为：

[root@fabric-cli client-01]# fabric-ca-client reenroll -H $PWD
    2018/05/05 09:57:35 [INFO] Configuration file location: /root/client-01/fabric-ca-client-config.yaml
    2018/05/05 09:57:35 [INFO] generating key: &{A:ecdsa S:256}
    2018/05/05 09:57:35 [INFO] encoded CSR
    2018/05/05 09:57:35 [INFO] Stored client certificate at /root/client-01/msp/signcerts/cert.pem
    2018/05/05 09:57:35 [INFO] Stored root CA certificate at /root/client-01/msp/cacerts/localhost-7054.pem
    2018/05/05 09:57:35 [INFO] Stored intermediate CA certificates at /root/client-01/msp/intermediatecerts/localhost-7054.pem

重新登记过程重新发送签名证书请求，获取新的数字证书。  
打开server端数据库，可以看到两条颁发给节点admin2的证书记录，两个证书颁发的时间不一样。

sqlite> select * from certificates;
    admin|13e477aa7b82cedbf5cd7a048499113b07ccb2b1|f90f3164321708d0136aba39debee493adef2da||good|0|2019-05-05 01:46:00+00:00|0001-01-01 00:00:00+00:00|-----BEGIN CERTIFICATE-----
    MIICPjCCAeSgAwIBAgIUE+R3qnuCztv1zXoEhJkROwfMsrEwCgYIKoZIzj0EAwIw
    aDELMAkGA1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQK
    EwtIeXBlcmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRkwFwYDVQQDExBmYWJyaWMt
    Y2Etc2VydmVyMB4XDTE4MDUwNTAxNDEwMFoXDTE5MDUwNTAxNDYwMFowXTELMAkG
    A1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQKEwtIeXBl
    cmxlZGdlcjEPMA0GA1UECxMGY2xpZW50MQ4wDAYDVQQDEwVhZG1pbjBZMBMGByqG
    SM49AgEGCCqGSM49AwEHA0IABBfB1sXja/H8BTnyvmHxhq2CqfmQFmNJyZa6w4zw
    fuN94luslQ2HBSiaNWgeKNjM3GzYKMdxnNTadkY/JaguLrOjdzB1MA4GA1UdDwEB
    /wQEAwIHgDAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBSFIoO+i0EDfSif4smmQgQh
    XkisczAfBgNVHSMEGDAWgBQPkPMWQyFwjQE2q6Od6+5JOt7y2jAVBgNVHREEDjAM
    ggpmYWJyaWMtY2xpMAoGCCqGSM49BAMCA0gAMEUCIQDOKII56tG+c1pZDQHVV0yD
    SRrZqVJTr26ISYXCV5Y/dAIgOGAn71VZ6v7AQoAZGV8zIIut1Yt6b/5o6RYHdXWB
    Ngs=
    -----END CERTIFICATE-----
    |1
    admin2|48a39095760013a4b0a7987722155c695455f946|f90f3164321708d0136aba39debee493adef2da||good|0|2019-05-05 01:54:00+00:00|0001-01-01 00:00:00+00:00|-----BEGIN CERTIFICATE-----
    MIICyTCCAm+gAwIBAgIUSKOQlXYAE6Swp5h3IhVcaVRV+UYwCgYIKoZIzj0EAwIw
    aDELMAkGA1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQK
    EwtIeXBlcmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRkwFwYDVQQDExBmYWJyaWMt
    Y2Etc2VydmVyMB4XDTE4MDUwNTAxNDkwMFoXDTE5MDUwNTAxNTQwMFowfTELMAkG
    A1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQKEwtIeXBl
    cmxlZGdlcjEuMAsGA1UECxMEdXNlcjALBgNVBAsTBG9yZzEwEgYDVQQLEwtkZXBh
    cnRtZW50MTEPMA0GA1UEAxMGYWRtaW4yMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
    QgAEv6uyVrYvccW2JKx970ssQxZSrIlH+vEcm20aaxWqZOQCBfwUAIo82H+79hg5
    bkPQiOKjVNeVK1lspGzJuEKgYaOB4TCB3jAOBgNVHQ8BAf8EBAMCB4AwDAYDVR0T
    AQH/BAIwADAdBgNVHQ4EFgQUIsG+F7zV+YJUu5LUD2Hs5JcFiiwwHwYDVR0jBBgw
    FoAUD5DzFkMhcI0BNqujnevuSTre8towFQYDVR0RBA4wDIIKZmFicmljLWNsaTBn
    BggqAwQFBgcIAQRbeyJhdHRycyI6eyJoZi5BZmZpbGlhdGlvbiI6Im9yZzEuZGVw
    YXJ0bWVudDEiLCJoZi5FbnJvbGxtZW50SUQiOiJhZG1pbjIiLCJoZi5UeXBlIjoi
    dXNlciJ9fTAKBggqhkjOPQQDAgNIADBFAiEA3ffGpEK32v9ig+EygVgDkEYC1VHW
    90UIZjALrnS/egMCIEFDnwWRSFTQ2oYDUA5C+ZroTvDz1VPJQrcaMlKLjWOm
    -----END CERTIFICATE-----
    |1
    admin2|6892d7d741f433c9a4ad66103d32ddb46b4085ce|f90f3164321708d0136aba39debee493adef2da||good|0|2019-05-05 01:58:00+00:00|0001-01-01 00:00:00+00:00|-----BEGIN CERTIFICATE-----
    MIICyDCCAm+gAwIBAgIUaJLX10H0M8mkrWYQPTLdtGtAhc4wCgYIKoZIzj0EAwIw
    aDELMAkGA1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQK
    EwtIeXBlcmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRkwFwYDVQQDExBmYWJyaWMt
    Y2Etc2VydmVyMB4XDTE4MDUwNTAxNTMwMFoXDTE5MDUwNTAxNTgwMFowfTELMAkG
    A1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQKEwtIeXBl
    cmxlZGdlcjEuMAsGA1UECxMEdXNlcjALBgNVBAsTBG9yZzEwEgYDVQQLEwtkZXBh
    cnRtZW50MTEPMA0GA1UEAxMGYWRtaW4yMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
    QgAEvwg0s4et+TywcGv+zNyA1wTtHNZMlosHF6Asqd5rsuv+dISqNQiMpeA/F3qt
    DYnHPihSLlKNycvJNSyDjra1zaOB4TCB3jAOBgNVHQ8BAf8EBAMCB4AwDAYDVR0T
    AQH/BAIwADAdBgNVHQ4EFgQUcpZvmm4utQpA6gjxQ4k0hEGpSFUwHwYDVR0jBBgw
    FoAUD5DzFkMhcI0BNqujnevuSTre8towFQYDVR0RBA4wDIIKZmFicmljLWNsaTBn
    BggqAwQFBgcIAQRbeyJhdHRycyI6eyJoZi5BZmZpbGlhdGlvbiI6Im9yZzEuZGVw
    YXJ0bWVudDEiLCJoZi5FbnJvbGxtZW50SUQiOiJhZG1pbjIiLCJoZi5UeXBlIjoi
    dXNlciJ9fTAKBggqhkjOPQQDAgNHADBEAiB0zbnY+Hvjj49lHanOwSXokCxedV17
    cPHFMnJuzek14AIgN4CPtMtQuUAXSm3VIg43qi1oReKC2SO76SwF0hcKcmY=
    -----END CERTIFICATE-----
    |1

**注销证书**  
注销证书的命令为

fabric-ca-client revoke -e <enrollment_id> -r <reason>

其中reason参数可以为：  
1. keycompromise  
2. cacompromise  
3. affiliationchange  
4. superseded  
5. cessationofoperation  
6. certificatehold  
7. removefromcrl  
8. privilegewithdrawn  
9. aacompromise  
10. unspecified  
下面我们注销掉刚刚登记的admin2节点试一下，执行命令`fabric-ca-client revoke -H $PWD -e admin2`：  
执行结果如下：

[root@fabric-cli client-01]# fabric-ca-client revoke -H $PWD -e admin2
    2018/05/05 10:01:32 [INFO] Configuration file location: /root/client-01/fabric-ca-client-config.yaml
    2018/05/05 10:01:32 [INFO] Sucessfully revoked certificates: [{
       Serial:48a39095760013a4b0a7987722155c695455f946 AKI:f90f3164321708d0136aba39debee493adef2da} {
       Serial:6892d7d741f433c9a4ad66103d32ddb46b4085ce AKI:f90f3164321708d0136aba39debee493adef2da}]

改为已注销

|1
    admin2|48a39095760013a4b0a7987722155c695455f946|f90f3164321708d0136aba39debee493adef2da||revoked|0|2019-05-05 01:54:00+00:00|2018-05-05 02:01:32|-----BEGIN CERTIFICATE-----
    MIICyTCCAm+gAwIBAgIUSKOQlXYAE6Swp5h3IhVcaVRV+UYwCgYIKoZIzj0EAwIw
    aDELMAkGA1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQK
    EwtIeXBlcmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRkwFwYDVQQDExBmYWJyaWMt
    Y2Etc2VydmVyMB4XDTE4MDUwNTAxNDkwMFoXDTE5MDUwNTAxNTQwMFowfTELMAkG
    A1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQKEwtIeXBl
    cmxlZGdlcjEuMAsGA1UECxMEdXNlcjALBgNVBAsTBG9yZzEwEgYDVQQLEwtkZXBh
    cnRtZW50MTEPMA0GA1UEAxMGYWRtaW4yMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
    QgAEv6uyVrYvccW2JKx970ssQxZSrIlH+vEcm20aaxWqZOQCBfwUAIo82H+79hg5
    bkPQiOKjVNeVK1lspGzJuEKgYaOB4TCB3jAOBgNVHQ8BAf8EBAMCB4AwDAYDVR0T
    AQH/BAIwADAdBgNVHQ4EFgQUIsG+F7zV+YJUu5LUD2Hs5JcFiiwwHwYDVR0jBBgw
    FoAUD5DzFkMhcI0BNqujnevuSTre8towFQYDVR0RBA4wDIIKZmFicmljLWNsaTBn
    BggqAwQFBgcIAQRbeyJhdHRycyI6eyJoZi5BZmZpbGlhdGlvbiI6Im9yZzEuZGVw
    YXJ0bWVudDEiLCJoZi5FbnJvbGxtZW50SUQiOiJhZG1pbjIiLCJoZi5UeXBlIjoi
    dXNlciJ9fTAKBggqhkjOPQQDAgNIADBFAiEA3ffGpEK32v9ig+EygVgDkEYC1VHW
    90UIZjALrnS/egMCIEFDnwWRSFTQ2oYDUA5C+ZroTvDz1VPJQrcaMlKLjWOm
    -----END CERTIFICATE-----
    |1
    admin2|6892d7d741f433c9a4ad66103d32ddb46b4085ce|f90f3164321708d0136aba39debee493adef2da||revoked|0|2019-05-05 01:58:00+00:00|2018-05-05 02:01:32|-----BEGIN CERTIFICATE-----
    MIICyDCCAm+gAwIBAgIUaJLX10H0M8mkrWYQPTLdtGtAhc4wCgYIKoZIzj0EAwIw
    aDELMAkGA1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQK
    EwtIeXBlcmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRkwFwYDVQQDExBmYWJyaWMt
    Y2Etc2VydmVyMB4XDTE4MDUwNTAxNTMwMFoXDTE5MDUwNTAxNTgwMFowfTELMAkG
    A1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQKEwtIeXBl
    cmxlZGdlcjEuMAsGA1UECxMEdXNlcjALBgNVBAsTBG9yZzEwEgYDVQQLEwtkZXBh
    cnRtZW50MTEPMA0GA1UEAxMGYWRtaW4yMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
    QgAEvwg0s4et+TywcGv+zNyA1wTtHNZMlosHF6Asqd5rsuv+dISqNQiMpeA/F3qt
    DYnHPihSLlKNycvJNSyDjra1zaOB4TCB3jAOBgNVHQ8BAf8EBAMCB4AwDAYDVR0T
    AQH/BAIwADAdBgNVHQ4EFgQUcpZvmm4utQpA6gjxQ4k0hEGpSFUwHwYDVR0jBBgw
    FoAUD5DzFkMhcI0BNqujnevuSTre8towFQYDVR0RBA4wDIIKZmFicmljLWNsaTBn
    BggqAwQFBgcIAQRbeyJhdHRycyI6eyJoZi5BZmZpbGlhdGlvbiI6Im9yZzEuZGVw
    YXJ0bWVudDEiLCJoZi5FbnJvbGxtZW50SUQiOiJhZG1pbjIiLCJoZi5UeXBlIjoi
    dXNlciJ9fTAKBggqhkjOPQQDAgNHADBEAiB0zbnY+Hvjj49lHanOwSXokCxedV17
    cPHFMnJuzek14AIgN4CPtMtQuUAXSm3VIg43qi1oReKC2SO76SwF0hcKcmY=
    -----END CERTIFICATE-----
    |1

**注册一个中间CA**

[root@fabric-cli peer]# fabric-ca-server start -b admin1:adminpw1 -p 7055 -H $PWD -u http://admin:adminpw@localhost:7054 2018/05/05 10:04:14 [INFO] Created default configuration file at /root/peer/fabric-ca-server-config.yaml 2018/05/05 10:04:14 [INFO] Starting server in home directory: /root/peer 2018/05/05 10:04:14 [INFO] Server Version: 1.1.0 2018/05/05 10:04:14 [INFO] Server Levels: &{ Identity:1 Affiliation:1 Certificate:1} 2018/05/05 10:04:14 [INFO] generating key: &{A:ecdsa S:256} 2018/05/05 10:04:14 [INFO] encoded CSR 2018/05/05 10:04:15 [INFO] The CA key and certificate were generated for CA 2018/05/05 10:04:15 [INFO] The key was stored by BCCSP provider 'SW' 2018/05/05 10:04:15 [INFO] The certificate is at: /root/peer/ca-cert.pem 2018/05/05 10:04:15 [INFO] Initialized sqlite3 database at /root/peer/fabric-ca-server.db 2018/05/05 10:04:15 [INFO] Home directory for default CA: /root/peer 2018/05/05 10:04:15 [INFO] Listening on http://0.0.0.0:7055

上述命令重新启动了一个CA服务器，作为引导节点CA服务器下的中间CA

打开ca-chain.pem查看刚刚登记的中间CA服务器证书链：

[root@fabric-cli client-02]# cat ../peer/ca-chain.pem 
    -----BEGIN CERTIFICATE-----
    MIICLTCCAdOgAwIBAgIUFXJxtOHxn8zBjYPIjQMRr/3oztYwCgYIKoZIzj0EAwIw
    aDELMAkGA1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQK
    EwtIeXBlcmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRkwFwYDVQQDExBmYWJyaWMt
    Y2Etc2VydmVyMB4XDTE4MDUwNTAxNTkwMFoXDTIzMDUwNDAyMDQwMFowXTELMAkG
    A1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQKEwtIeXBl
    cmxlZGdlcjEPMA0GA1UECxMGY2xpZW50MQ4wDAYDVQQDEwVhZG1pbjBZMBMGByqG
    SM49AgEGCCqGSM49AwEHA0IABOKxAKDUklNUmNMFnT034yp5UtSupyTz+Lu+Drv0
    RxX7ydBVIAeZmXrEX17pdNpVye8pqdo02YpNnbteZ1tRJ9CjZjBkMA4GA1UdDwEB
    /wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBTHr+fY0av7Ix03
    puo921GDhhvRtjAfBgNVHSMEGDAWgBQPkPMWQyFwjQE2q6Od6+5JOt7y2jAKBggq
    hkjOPQQDAgNIADBFAiEArb4HQ6SAfPiaYH72Et4T/byQyBBaNBrtP40cXuKlRXAC
    IFPG5bNs4Vlxd45yTaFokeV4vm0Q2XxYg+sOIQ1VK/gS
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    MIICFjCCAb2gAwIBAgIUeUjLMw6gVNNf+GjGZjyPVysBJ7AwCgYIKoZIzj0EAwIw
    aDELMAkGA1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQK
    EwtIeXBlcmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRkwFwYDVQQDExBmYWJyaWMt
    Y2Etc2VydmVyMB4XDTE4MDUwNTAxMzcwMFoXDTMzMDUwMTAxMzcwMFowaDELMAkG
    A1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQKEwtIeXBl
    cmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRkwFwYDVQQDExBmYWJyaWMtY2Etc2Vy
    dmVyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEILG2FJ+c37twKNojFB6ErPgq
    gvaKYvlIlu8TPUP3GYQn2pFYkf/Xn1C5Y2xZYwG3D5r3N7O9NUJKMC6TB5Z2MKNF
    MEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYE
    FA+Q8xZDIXCNATaro53r7kk63vLaMAoGCCqGSM49BAMCA0cAMEQCIGWQZ7bZ12Ob
    +1epkoK7jueC9LdLqemwPsFa84PEU308AiBEWnAwqSigWwoO7Ed42/MWBdPJ4He1
    q3OfQswaV1izvQ==
    -----END CERTIFICATE-----

服务端返回的结果

2018/05/05 10:04:15 [INFO] signed certificate with serial number 122440996379400339443912371377871659726075907798
    2018/05/05 10:04:15 [INFO] [::1]:53468 POST /enroll 201 0 "OK"

可以看到证书链中包含上级CA证书和自己的证书信息。

尝试在刚刚建立的CA server上注册登记一个节点，注册一个节点admin2的命令同上：  
首先登记节点：

[root@fabric-cli client-02]# fabric-ca-client enroll -H /root/client-02/ -u http://admin1:adminpw1@localhost:7055
    2018/05/05 10:40:46 [INFO] generating key: &{A:ecdsa S:256}
    2018/05/05 10:40:46 [INFO] encoded CSR
    2018/05/05 10:40:46 [INFO] Stored client certificate at /root/client-02/msp/signcerts/cert.pem
    2018/05/05 10:40:46 [INFO] Stored root CA certificate at /root/client-02/msp/cacerts/localhost-7055.pem
    2018/05/05 10:40:46 [INFO] Stored intermediate CA certificates at /root/client-02/msp/intermediatecerts/localhost-7055.pem
    
    [root@fabric-cli client-02]# fabric-ca-client register --id.name admin2 --home $PWD --id.type user --id.affiliation org1.department1 --id.attrs 'hf.Revoker=true,foo=bar'
    2018/05/05 10:41:39 [INFO] Configuration file location: /root/client-02/fabric-ca-client-config.yaml
    Password: JSidQazllwLg

注册的结果已经记录在数据库中：

admin1|$2a$10$JPn9fBs7RlsiV8YrAMc3Auw5Gl7Lse6UQCml7UgKMCOqjXGm8TJ82|client||[{
       "name":"hf.GenCRL","value":"1"},{
       "name":"hf.Registrar.Attributes","value":"*"},{
       "name":"hf.AffiliationMgr","value":"1"},{
       "name":"hf.Registrar.Roles","value":"peer,orderer,client,user"},{
       "name":"hf.Registrar.DelegateRoles","value":"peer,orderer,client,user"},{
       "name":"hf.Revoker","value":"1"},{
       "name":"hf.IntermediateCA","value":"1"}]|1|-1|1
    admin2|$2a$10$Il4HKQmTBi1/3/mqXED2g.3E.WwpEyin3hUB16CTkx72cdXmMBCfm|user|org1.department1|[{
       "name":"hf.Revoker","value":"true"},{
       "name":"foo","value":"bar"},{
       "name":"hf.EnrollmentID","value":"admin2","ecert":true},{
       "name":"hf.Type","value":"user","ecert":true},{
       "name":"hf.Affiliation","value":"org1.department1","ecert":true}]|0|-1|1

最后登记节点

[root@fabric-cli client-02]# fabric-ca-client enroll -H $PWD -u http://admin2:JSidQazllwLg@localhost:7055 -M $PWD/msp
    2018/05/05 10:44:32 [INFO] generating key: &{A:ecdsa S:256}
    2018/05/05 10:44:32 [INFO] encoded CSR
    2018/05/05 10:44:33 [INFO] Stored client certificate at /root/client-02/msp/signcerts/cert.pem
    2018/05/05 10:44:33 [INFO] Stored root CA certificate at /root/client-02/msp/cacerts/localhost-7055.pem
    2018/05/05 10:44:33 [INFO] Stored intermediate CA certificates at /root/client-02/msp/intermediatecerts/localhost-7055.pem

进入刚刚登记的节点目录，生成如下目录结构：

[root@fabric-cli client-02]# tree
    .
    ├── fabric-ca-client-config.yaml
    └── msp
        ├── cacerts
        │   └── localhost-7055.pem
        ├── intermediatecerts
        │   └── localhost-7055.pem
        ├── keystore
        │   ├── cb53d5219a75795f24e6a0a3bc549751ab56c94f426db55c3a64b1e780706306_sk
        │   ├── cf752a33b03984a35c2fa616546405592b44d6d75af240a8dd4c606cf41a0b2c_sk
        │   └── fb9a467ebd39d3f6a0a0cf668323093f104313085676322d6c95f32257efa6b2_sk
        └── signcerts
            └── cert.pem
    
    5 directories, 7 files

[root@fabric-cli client-02]# cat msp/cacerts/localhost-7055.pem 
    -----BEGIN CERTIFICATE-----
    MIICFjCCAb2gAwIBAgIUeUjLMw6gVNNf+GjGZjyPVysBJ7AwCgYIKoZIzj0EAwIw
    aDELMAkGA1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQK
    EwtIeXBlcmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRkwFwYDVQQDExBmYWJyaWMt
    Y2Etc2VydmVyMB4XDTE4MDUwNTAxMzcwMFoXDTMzMDUwMTAxMzcwMFowaDELMAkG
    A1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQKEwtIeXBl
    cmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRkwFwYDVQQDExBmYWJyaWMtY2Etc2Vy
    dmVyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEILG2FJ+c37twKNojFB6ErPgq
    gvaKYvlIlu8TPUP3GYQn2pFYkf/Xn1C5Y2xZYwG3D5r3N7O9NUJKMC6TB5Z2MKNF
    MEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYE
    FA+Q8xZDIXCNATaro53r7kk63vLaMAoGCCqGSM49BAMCA0cAMEQCIGWQZ7bZ12Ob
    +1epkoK7jueC9LdLqemwPsFa84PEU308AiBEWnAwqSigWwoO7Ed42/MWBdPJ4He1
    q3OfQswaV1izvQ==
    -----END CERTIFICATE-----

打开cacerts下面的证书链文件，可以看到刚刚登记的节点证书链包含两个中间CA的数字证书信息，在验证由该个树形CA服务器中一个中间CA节点所颁发的数字证书是否真实有效时，会按照证书链自下向上进行验证，直至到达根证书。

如果区块链网络中有多个链，每个链为了保证各自的隐私性存在各自的CA服务器，那么当一个用户同时拥有两个链的权限时，怎样同时具备验证两个链上的节点所拥有的CA证书呢？按照上边证书链的原则，一个节点注册登记到一个中间CA后，应该只能拥有该条CA服务器链上的证书链。这里为了解决这个问题，有一种方法是交叉认证，在fabric-ca中也有类似的操作方法，即通过Restful接口获取另外一个CA服务器上的证书链。  
具体命令为：

fabric-ca-client getcacert -u http://localhost:7055 -M $PWD/msp

这里我们新建一个单独运行的CA服务器：

[root@fabric-cli server03]# fabric-ca-server start -b admin3:adminpw3 -p 7056 2018/05/05 10:49:54 [INFO] Configuration file location: /root/server03/fabric-ca-server-config.yaml 2018/05/05 10:49:54 [INFO] Starting server in home directory: /root/server03 2018/05/05 10:49:54 [INFO] Server Version: 1.1.0 2018/05/05 10:49:54 [INFO] Server Levels: &{ Identity:1 Affiliation:1 Certificate:1} 2018/05/05 10:49:54 [INFO] The CA key and certificate already exist 2018/05/05 10:49:54 [INFO] The key is stored by BCCSP provider 'SW' 2018/05/05 10:49:54 [INFO] The certificate is at: /root/server03/ca-cert.pem 2018/05/05 10:49:54 [INFO] Initialized sqlite3 database at /root/server03/fabric-ca-server.db 2018/05/05 10:49:54 [INFO] Home directory for default CA: /root/server03 2018/05/05 10:49:54 [INFO] Listening on http://0.0.0.0:7056

查看该根服务器的数字证书

[root@fabric-cli server03]# cat ca-cert.pem 
    -----BEGIN CERTIFICATE-----
    MIICFjCCAb2gAwIBAgIUX2OUUlwjOgBzUIh4FZoKG3OcqWkwCgYIKoZIzj0EAwIw
    aDELMAkGA1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQK
    EwtIeXBlcmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRkwFwYDVQQDExBmYWJyaWMt
    Y2Etc2VydmVyMB4XDTE4MDUwNTAyNDQwMFoXDTMzMDUwMTAyNDQwMFowaDELMAkG
    A1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMRQwEgYDVQQKEwtIeXBl
    cmxlZGdlcjEPMA0GA1UECxMGRmFicmljMRkwFwYDVQQDExBmYWJyaWMtY2Etc2Vy
    dmVyMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEMWTVtjZESsvaz1o9zD/KZlzo
    I150vSMyHP1zGimYsd/4a2RRh5iy7Weovkrqi8gRQBIOX+J2hC2bTgij36hSzKNF
    MEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYE
    FGdQoahILdWtPrClncg683eZNWMbMAoGCCqGSM49BAMCA0cAMEQCIGaqW75T4Woo
    xzAxzFjZynBhk26QicgSSFOc2yHANotvAiAj/33gLW1Qj4Iil9ghbFDDuSBY7yPp
    Xa4EqymGTCp/Eg==
    -----END CERTIFICATE-----

接下来，我们在上文登记的节点admin2上运行获取刚刚建立的CA服务器证书链命令

root@fabric-cli client-03]# fabric-ca-client getcacert -u http://localhost:7056 -M ../client-02/msp 
    2018/05/05 10:54:39 [INFO] Configuration file location: /root/.fabric-ca-client/fabric-ca-client-config.yaml
    2018/05/05 10:54:39 [INFO] Stored root CA certificate at /root/client-02/msp/cacerts/localhost-7056.pem
    2018/05/05 10:54:39 [INFO] Stored intermediate CA certificates at /root/client-02/msp/intermediatecerts/localhost-7056.pem

执行命令结束后，查看admin2节点所对应的证书链目录：

[root@fabric-cli client-02]# tree
    .
    ├── fabric-ca-client-config.yaml
    └── msp
        ├── cacerts
        │   ├── localhost-7055.pem
        │   └── localhost-7056.pem
        ├── intermediatecerts
        │   ├── localhost-7055.pem
        │   └── localhost-7056.pem
        ├── keystore
        │   ├── cb53d5219a75795f24e6a0a3bc549751ab56c94f426db55c3a64b1e780706306_sk
        │   ├── cf752a33b03984a35c2fa616546405592b44d6d75af240a8dd4c606cf41a0b2c_sk
        │   └── fb9a467ebd39d3f6a0a0cf668323093f104313085676322d6c95f32257efa6b2_sk
        └── signcerts
            └── cert.pem
    
    5 directories, 9 files

可以看到启动在端口7056上的CA服务器所对应的证书链已经同步过来了。

Fabric-ca这个模块详细描述了CA工作过程中使用fabric-ca-client和sdk方式的方法，其中包括配置LDAP以及其他数据库的配置方法在文中也有说明，sdk方式的restful操作接口，可以查看fabric-ca源码根目录下的swagger.json文件。使用中需要根据区块链网络的特性，使用CA签发的数字证书进行认证、加密传输数据、授权用户、管理用户证书。

参考:  
[HYPERLEDGER FABRIC-CA学习][HYPERLEDGER FABRIC-CA]  
[fabric-ca][]

[01]: /images/20220525/7adcd60ef52640dca74283dff2f99a87.png
[https_github.com_hyperledger_fabric-ca]: https://github.com/hyperledger/fabric-ca
[fa]: /images/20220525/67675cd8f92846ff81d95f04ef26e8a8.png
[HYPERLEDGER FABRIC-CA]: https://www.cnblogs.com/midfielder/p/7173121.html
[fabric-ca]: http://hyperledger-fabric-ca.readthedocs.io/en/latest/