hyperledger-fabric - super 账本结构 : ServerHandshake TLS handshake bad certificate server=PeerServer AND ServerHandshake TLS handshake EOF

Question

我尝试使用 Hyperledger 版本 2.0.0 将我的 Golang 后端连接到正在运行的 Hyperledger 网络...

我在运行“docker-compose up”时看到这个 ServerHandshake TLS 握手 EOF 错误:

peer0-org2 | 2020-06-21 04:56:29.113 UTC [core.comm] ServerHandshake -> ERRO 022 TLS 握手失败，错误为 EOF server=PeerServer remoteaddress=172.21.0.12:51946

peer1-org1 | 2020-06-21 04:56:30.123 UTC [core.comm] ServerHandshake -> ERRO 021 TLS 握手失败，错误为 EOF server=PeerServer remoteaddress=172.21.0.11:49860

peer0-org1 | 2020-06-21 04:56:30.547 UTC [core.comm] ServerHandshake -> ERRO 022 TLS 握手失败，错误为 EOF server=PeerServer remoteaddress=172.21.0.9:34994

peer1-org2 | 2020-06-21 04:56:30.873 UTC [core.comm] ServerHandshake -> ERRO 021 TLS 握手失败，错误为 EOF server=PeerServer remoteaddress=172.21.0.10:52232

然后我在运行我的 Golang 后端以访问链代码时看到了类似的 ServerHandshake TLS 握手错误(ServerHandshake TLS 握手错误证书)...以及来自 Golang 的其他错误消息:

--- 失败:Test_ConnectionTest_Success (0.06s)client_test.go:30: 无法从 channel 上下文创建客户端:事件服务创建失败:无法获取 chConfig 缓存引用:QueryBlockConfig 失败:QueryBlockConfig 失败:queryChaincode 失败:背书人的交易处理 [localhost:7051]:背书人客户端状态代码: (2) 连接失败。描述:在目标 [localhost:7051] 上拨号连接:连接处于 TRANSIENT_FAILURE

失败

退出状态 1

失败 hyperledger-k8s-be/hyperledger 0.068s

------------== 来自 docker-compose up Hyperledger 终端

peer0-org1 | 2020-06-21 06:00:24.577 UTC [core.comm] ServerHandshake -> ERRO 090 TLS 握手失败，出现错误远程错误:tls: 错误证书服务器=PeerServer remoteaddress=172.20.0.1:58500

------------==它在 client.go 中失败了

channelClient, 错误:= sdkchannel.New(clientContext)

如果错误!=无{return nil, errors.WithMessage(err, "unable to make client from channel context")

------------==我怀疑这三个证书之一在 docker-compose.yaml > peer0-org1 > 环境中不正确

  - CORE_PEER_TLS_CERT_FILE=/etc/hyperledger/fabric/tls/server.crt
  - CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/fabric/tls/server.key
  - CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/fabric/tls/ca.crt

我的猜测是否正确？有什么问题？

docker-compose-ca.yaml 不正确是因为

  hyperledger/fabric-ca:1.4.1

  the start-org1-client script to run under org1-client

  something else???

请帮忙。谢谢

------------== 2020 年 6 月 23 日更新我可以通过 $ openssl x509 -noout -text -in org1-ca-7054.pem 检查 TLS 证书是否具有正确的 SAN(主题备用名称

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:3b:4f:ea:63:1a:03:b4:61:45:e9:44:1b:29:dc:ed:e6:bc:0b:76
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = US, ST = North Carolina, O = Hyperledger, OU = Fabric, CN = fabric-ca-server
        Validity
            Not Before: Jun 21 05:14:00 2020 GMT
            Not After : Jun 18 05:14:00 2035 GMT
        Subject: C = US, ST = North Carolina, O = Hyperledger, OU = Fabric, CN = fabric-ca-server
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:3c:3f:d9:97:7e:fc:08:e5:0a:3f:fe:b3:fe:70:
                    33:20:92:6c:88:78:19:35:08:00:98:97:17:8b:af:
                    03:44:2d:a4:4d:65:63:fc:d8:b5:4c:23:cc:e6:63:
                    55:a3:4f:04:62:72:8d:b2:fa:f1:9a:9d:14:9f:f9:
                    aa:33:ee:fe:e8
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:1
            X509v3 Subject Key Identifier: 
                78:B7:6D:51:91:0C:9E:6C:31:C9:63:67:34:BD:CA:18:B5:C5:35:D1
    Signature Algorithm: ecdsa-with-SHA256
         30:44:02:20:6a:1a:92:cc:45:9b:c9:a5:4d:61:b9:bd:a3:94:
         b2:2c:52:7a:16:36:91:12:f9:a0:1f:fe:77:29:a3:1e:05:5d:
         02:20:7f:e0:5d:c9:03:4f:8e:b2:6d:66:a4:8f:04:fb:e0:e6:
         52:cf:e0:e9:3a:1a:36:bc:7b:98:99:f9:c4:64:c6:7e

因此响应没有 SAN 设置...

Answer 1

从错误来看，对等节点的 TLS 证书似乎没有配置正确的 SAN(主题备用名称)以正确验证 TLS 通信。

对等 TLS 证书应使用容器名称或容器的 IP 地址或 localhost 配置 SAN，无论您使用哪个来向节点发送请求。

注意:在其 TLS 证书中可以为单个节点配置多个 SAN。