hyperledger-fabric - 在对等节点上创建 channel 失败

Question

官方的hyperledger fabric v1.0.0使用docker做了一个简单的demo。这是链接。

我做的是避开docker，直接在机器上运行。多亏了我上一个问题的答案，我已经成功地启动了 1 个独立订购者和两个同行，每个都来自一个组织。

这是订购者配置 orderer.yaml 的一部分，我确信与 tls 相关的路径设置正确。

General:

    # Ledger Type: The ledger type to provide to the orderer.
    # Two non-production ledger types are provided for test purposes only:
    #  - ram: An in-memory ledger whose contents are lost on restart.
    #  - json: A simple file ledger that writes blocks to disk in JSON format.
    # Only one production ledger type is provided:
    #  - file: A production file-based ledger.
    LedgerType: file

    # Listen address: The IP on which to bind to listen.
    ListenAddress: 127.0.0.1

    # Listen port: The port on which to bind to listen.
    ListenPort: 7040

    # TLS: TLS settings for the GRPC server.
    TLS:
        Enabled: true
        PrivateKey: ordererOrganizations/example.com/orderers/orderer.example.com/tls/server.key
        Certificate: ordererOrganizations/example.com/orderers/orderer.example.com/tls/server.crt
        RootCAs:
          - ordererOrganizations/example.com/orderers/orderer.example.com/tls/ca.crt
        ClientAuthEnabled: false
        ClientRootCAs:

    # Log Level: The level at which to log. This accepts logging specifications
    # per: fabric/docs/Setup/logging-control.md
    LogLevel: debug

但是，当我想使用如下命令创建 channel 时:

export FABRIC_CFG_PATH=$PWD
export CHANNEL_NAME=my_channel
export CORE_PEER_LOCALMSPID="Org1MSP"

export CORE_PEER_TLS_ROOTCERT_FILE=crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt

export CORE_PEER_MSPCONFIGPATH=crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp

export CORE_PEER_ADDRESS=127.0.0.1:7001

peer channel create -o 127.0.0.1:7040 -c $CHANNEL_NAME -f channel-artifacts/channel.tx --tls true --cafile $ORDERER_CA >&log.txt

日志报错如下:

Error: Error connecting due to  rpc error: code = Internal desc = connection error: desc = "transport: authentication handshake failed: x509: cannot validate certificate for 127.0.0.1 because it doesn't contain any IP SANs"

我认为这与 tls 配置问题有关。我对它不是很熟悉。任何人都可以帮助我解决这个简单的问题并给我一个简单的解释吗？

Answer 1

该错误是由于 TLS 层的主机名验证失败引起的。TLS 证书没有 IP 主题备用名称 (SAN) - 它们只有基于 DNS 的 SAN。

最简单的做法是将主机条目添加到您的 /etc/hosts 文件中(假设您在 Linux 或 macOS 上运行)。假设您在同一台机器上运行所有内容，然后将以下行添加到您的 /etc/hosts 应该可以解决您的问题:

127.0.0.1       localhost orderer peer0.org1.example.com peer0.org2.example.com

然后确保使用主机名而不是 IP 地址:

export FABRIC_CFG_PATH=$PWD
export CHANNEL_NAME=my_channel
export CORE_PEER_LOCALMSPID="Org1MSP"

export CORE_PEER_TLS_ROOTCERT_FILE=crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt

export CORE_PEER_MSPCONFIGPATH=crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp

export CORE_PEER_ADDRESS=peer0.org1.example.com:7001

peer channel create -o orderer:7040 -c $CHANNEL_NAME -f channel-artifacts/channel.tx --tls true --cafile $ORDERER_CA >&log.txt