fabric-ca

一 .fabric-ca加载openssl生成的ecdsa标准证书

1. 生成椭圆加密根证书步骤

• 生成私钥

openssl ecparam -name prime256v1 -genkey -out ca-key_.pem

• 私钥转换成pk8格式

openssl pkcs8 -inform PEM -outform PEM -topk8 -nocrypt -in ca-key_.pem -out ca-key.pem

• 创建生成证书请求

openssl req -config openssl.cnf -new -key ca-key.pem -out cert-req.csr

openssl.conf内容见(1)

• 生成自签名证书

openssl x509 -req   -extfile /usr/lib/ssl/openssl.cnf -extensions usr_cert  -in cert-req.csr -out ca-cert.pem -signkey ca-key.pem  -CAcreateserial -days 3650

2. 查看

• 查看cert-req.csr

openssl req -in cert-req.csr -text

• 查看ca-cert.pem

openssl x509 -in ca-cert.pem -text -noout

3. 加载ca-cert.pem证书,开启ca服务.

• 导入ca-cert.pem证书和ca-key.pem秘钥

mv ca-cert.pem ca-key.pem $GOPATH/src/github.com/hyperledger/fabric-ca/docker/server/fabric-ca-server

• 开启ca服务

cd $GOPATH/src/github.com/hyperledger/fabric-ca/docker/server/
docker-compose up

• 客户端申请证书

fabric-ca-client enroll -u http://admin:adminpw@localhost:7054

4. 参考

• markdown语法

• How to generate x509v3 Extensions in the End user certificate

• openssl生成SSL证书的流程

****************** 华丽的分割线 ******************

(1)openssl.conf

[ req ]
default_md              = sha256
default_keyfile         = ca-key.pem
distinguished_name      = req_distinguished_name
prompt = no
x509_extensions = v3_ca
req_extensions  = v3_req
x509_extensions = usr_cert
[ req_distinguished_name ]
C=US
ST=North Carolina
L=Raleigh
O=Example
CN=Example.com
[ usr_cert ]
basicConstraints=critical,CA:true,pathlen:1
keyUsage=critical, keyCertSign,cRLSign
subjectKeyIdentifier=hash
[ v3_req ]
basicConstraints=critical,CA:true,pathlen:1
keyUsage=critical, keyCertSign,cRLSign
subjectKeyIdentifier=hash

二.fabric-ca连接mysql

数据库版本必须是MySQL 5.7.X,

1. 配置yml文件

db:
  type: mysql
  datasource: root:rootpw@tcp(localhost:3306)/fabric_ca?parseTime=true&tls=custom
  tls:
      enabled: true
      certfiles:
        - db-server-cert.pem
      client:
            certfile: db-client-cert.pem
            keyfile: db-client-key.pem

2. 配置mysqlserver my.cnf

[mysqld] ssl-ca=ca-cert.pem ssl-cert=server-cert.pem ssl-key=server-key.pem

3. 查询ssl是否可用

# have_openssl have_ssl 
mysql> SHOW GLOBAL VARIABLES LIKE ‘have_%ssl’;

如果看见下面就ok了

4.创建用户

mysql> GRANT ALL PRIVILEGES ON . TO ‘ssluser’@’%’ IDENTIFIED BY ‘password’ REQUIRE SSL; mysql> FLUSH PRIVILEGES;