ssl - 为什么 fabric-ca 作为自签名证书启动？

Question

这是我对流程的理解。

version: '2'

services:

  shop_ca:
    image: hyperledger/fabric-ca
    environment:
      - FABRIC_CA_HOME=/etc/hyperledger/fabric-ca-server
      - FABRIC_CA_SERVER_CA_NAME=shop_ca
      - FABRIC_CA_SERVER_CA_CERTFILE=/etc/hyperledger/fabric-ca-server-config/ca-cert.pem
      - FABRIC_CA_SERVER_CA_KEYFILE=/etc/hyperledger/fabric-ca-server-config/ca-key.pem
    ports:
      - "7054:7054"
    command: sh -c 'fabric-ca-server start -b admin3:admin3'
    volumes:
      - ./conf.yaml:/etc/hyperledger/fabric-ca-server/fabric-ca-server-config.yaml
    container_name: shop_ca

我将我的证书文件和 key 文件作为选项传递。

当 fabric-ca-server 启动时，它应该做的是在/etc/hyperledger/fabric-ca-server 文件夹中创建 ca-cert 和 ca-key pem 文件。然后使用/etc/hyperledger/fabric-ca-server/fabric-ca-server-config.yaml 配置文件生成最终证书(路径必须是/etc/hyperledger/fabric-ca-server-config/ca-cert .pem) 将用于颁发其他证书。

我不明白的是这个生成的证书 /etc/hyperledger/fabric-ca-server-config/ca-cert.pem 是自签名的。问题是为什么？我认为它所做的是向 /etc/hyperledger/fabric-ca-server/ca-cert.pem 发出 csr 请求，这个 ca-cert.pem 发出另一个 ca-cert.pem。这个问题出现在我的脑海中，因为当我使用 openssl 并打印最终生成的 ca-cert 证书时，颁发者和主题都是相同的。我认为发行人必须是 /etc/hyperledger/fabric-ca-server/ca-cert.pem 主题必须是 /etc/hyperledger/fabric-ca-server-config/ca -cert.pem. 但颁发者和主题都是 /etc/hyperledger/fabric-ca-server-config/ca-cert.pem。为什么？

Answer 1

任何证书颁发机构的顶级根证书始终是自签名的(查看本文底部的 Verisign 证书)...这就是您明确信任根证书的原因。

Fabric CA 允许您指定现有的根 key 对，或者如果指定的文件不存在，它会为您生成它们。 (如果证书文件存在但找不到匹配的私钥，您将收到错误消息并且 fabric-ca-server 将不会启动)。

当 fabric-ca-server 生成自己的自签名 key 对时，它实际上会在 msp/keystore 文件夹中生成私钥，但它会将自签名 X509 证书存储在通过 FABRIC_CA_SERVER_CA_CERTFILE 指定的文件中，否则它将使用 fabric-ca-server-config.yaml 中的位置。请注意，如果您使用 FABRIC_CA_SERVER_CA_CERTFILE 覆盖，则该值不会在配置文件中更新(这可能会造成一些困惑)。

威瑞信初级

Garis-MBP:tmp gsingh$ openssl x509 -noout -text -in verisign.pem 
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
        Validity
            Not Before: Nov  8 00:00:00 2006 GMT
            Not After : Jul 16 23:59:59 2036 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:af:24:08:08:29:7a:35:9e:60:0c:aa:e7:4b:3b:
                    4e:dc:7c:bc:3c:45:1c:bb:2b:e0:fe:29:02:f9:57:
                    08:a3:64:85:15:27:f5:f1:ad:c8:31:89:5d:22:e8:
                    2a:aa:a6:42:b3:8f:f8:b9:55:b7:b1:b7:4b:b3:fe:
                    8f:7e:07:57:ec:ef:43:db:66:62:15:61:cf:60:0d:
                    a4:d8:de:f8:e0:c3:62:08:3d:54:13:eb:49:ca:59:
                    54:85:26:e5:2b:8f:1b:9f:eb:f5:a1:91:c2:33:49:
                    d8:43:63:6a:52:4b:d2:8f:e8:70:51:4d:d1:89:69:
                    7b:c7:70:f6:b3:dc:12:74:db:7b:5d:4b:56:d3:96:
                    bf:15:77:a1:b0:f4:a2:25:f2:af:1c:92:67:18:e5:
                    f4:06:04:ef:90:b9:e4:00:e4:dd:3a:b5:19:ff:02:
                    ba:f4:3c:ee:e0:8b:eb:37:8b:ec:f4:d7:ac:f2:f6:
                    f0:3d:af:dd:75:91:33:19:1d:1c:40:cb:74:24:19:
                    21:93:d9:14:fe:ac:2a:52:c7:8f:d5:04:49:e4:8d:
                    63:47:88:3c:69:83:cb:fe:47:bd:2b:7e:4f:c5:95:
                    ae:0e:9d:d4:d1:43:c0:67:73:e3:14:08:7e:e5:3f:
                    9f:73:b8:33:0a:cf:5d:3f:34:87:96:8a:ee:53:e8:
                    25:15
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            1.3.6.1.5.5.7.1.12: 
                0_.].[0Y0W0U..image/gif0!0.0...+..............k...j.H.,{..0%.#http://logo.verisign.com/vslogo.gif
            X509v3 Subject Key Identifier: 
                7F:D3:65:A7:C2:DD:EC:BB:F0:30:09:F3:43:39:FA:02:AF:33:31:33
    Signature Algorithm: sha1WithRSAEncryption
         93:24:4a:30:5f:62:cf:d8:1a:98:2f:3d:ea:dc:99:2d:bd:77:
         f6:a5:79:22:38:ec:c4:a7:a0:78:12:ad:62:0e:45:70:64:c5:
         e7:97:66:2d:98:09:7e:5f:af:d6:cc:28:65:f2:01:aa:08:1a:
         47:de:f9:f9:7c:92:5a:08:69:20:0d:d9:3e:6d:6e:3c:0d:6e:
         d8:e6:06:91:40:18:b9:f8:c1:ed:df:db:41:aa:e0:96:20:c9:
         cd:64:15:38:81:c9:94:ee:a2:84:29:0b:13:6f:8e:db:0c:dd:
         25:02:db:a4:8b:19:44:d2:41:7a:05:69:4a:58:4f:60:ca:7e:
         82:6a:0b:02:aa:25:17:39:b5:db:7f:e7:84:65:2a:95:8a:bd:
         86:de:5e:81:16:83:2d:10:cc:de:fd:a8:82:2a:6d:28:1f:0d:
         0b:c4:e5:e7:1a:26:19:e1:f4:11:6f:10:b5:95:fc:e7:42:05:
         32:db:ce:9d:51:5e:28:b6:9e:85:d3:5b:ef:a5:7d:45:40:72:
         8e:b7:0e:6b:0e:06:fb:33:35:48:71:b8:9d:27:8b:c4:65:5f:
         0d:86:76:9c:44:7a:f6:95:5c:f6:5d:32:08:33:a4:54:b6:18:
         3f:68:5c:f2:42:4a:85:38:54:83:5f:d1:e8:2c:f2:ac:11:d6:
         a8:ed:63:6a